Boss Media CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM Boss Media CVE published 2026-10-31

CVE-2026-96554

The BuddyBoss Platform plugin for WordPress has a Stored Cross-Site Scripting vulnerability via Group Name in all versions up to, and including, 3.6.0. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts when the 'Enable social group creation by all members' setting is enabled, which is the default.