Description

The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bf_post_type (and buddyforms_form_content)' parameter in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that at least one BuddyForms form with public submissions enabled exists on the site (so that the required nonce can be harvested from the public form page) and that the active theme registers a widgetized sidebar, allowing the injected customize_changeset to place a malicious Custom HTML widget into the site's front end.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-11-06T12:17:16.187Z",
  "pubdate": "2026-11-06T12:17:16.187Z",
  "executiveSummary": "The BuddyForms WordPress plugin is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 2.10.5.\nThe flaw stems from insufficient input sanitization and inadequate output escaping on the 'bf_post_type' and 'buddyforms_form_content' parameters.\nThis vulnerability allows unauthenticated attackers to inject and execute arbitrary JavaScript within the context of the victim's browser session.\nSuccessful exploitation requires specific preconditions: the existence of a BuddyForms form with public submission capabilities, which allows for the harvesting of a valid nonce, and the presence of an active theme with a widgetized sidebar to facilitate the injection of a malicious Custom HTML widget.\nThe impact includes potential account takeover, session hijacking, unauthorized redirection, and the defacement of the affected website, representing a significant security risk for WordPress administrators.\nAttackers can leverage this vulnerability to gain persistent execution of malicious payloads on pages visited by users.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of user-supplied data within the 'bf_post_type' and 'buddyforms_form_content' parameters. The application fails to sanitize inputs before storage and neglects to perform context-aware output escaping when rendering these inputs in the front-end interface.\nThe attack vector necessitates the use of a public-facing BuddyForms form. Since the plugin validates submissions using nonces, an unauthenticated attacker must first visit a page containing a public form to extract a valid nonce. Once the attacker has obtained a valid nonce, they can initiate a request to store malicious script content.\nThe exploitation flow proceeds as follows: First, the attacker crafts a payload containing malicious JavaScript. Second, they target the 'customize_changeset' functionality, leveraging the lack of input validation to inject a malicious Custom HTML widget into a sidebar defined by the active theme. Because BuddyForms processes these parameters during submission handling, the script is persisted in the database.\nThe payload is executed whenever an administrator or end-user navigates to a page where the compromised widget is rendered. Because the injection occurs via the theme's widgetized area, the script executes within the security context of the site, allowing the attacker to bypass standard same-origin policy restrictions in relation to the WordPress installation.\nThis vulnerability is particularly dangerous because it does not require administrative privileges to initiate the exploitation process, relying instead on the public accessibility of the form submission mechanism. The post-exploitation impact includes the ability to steal authentication cookies, perform unauthorized actions on behalf of authenticated users, or deliver further malicious content via the site's front end."
}