Medium severity · published May 16, 2026
CVE-2020-37233
WordPress Plugin Buddypress 6.2.0 Persistent Cross-Site Scripting
6.4
CVSS
0.3%
EPSS
No
On KEV
Description
WordPress Plugin Buddypress 6.2.0 contains a persistent cross-site scripting vulnerability that allows authenticated attackers with moderator privileges to inject malicious script code through the figure parameter in wp:html blocks. Attackers can inject iframe elements with event handlers like onload that execute when administrators or privileged users preview or view the affected page content, enabling session hijacking and persistent phishing attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WO
WordPress · WordPress
6.2.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-37233
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-37233
wordpress.org
https://wordpress.org/plugins/buddypress/
www.exploit-db.com
https://www.exploit-db.com/exploits/49061
www.vulncheck.com
https://www.vulncheck.com/advisories/wordpress-plugin-buddypress-persistent-cross-site-scripting
More from WordPress
9.8
CVE-2026-63030
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
9.8
CVE-2020-25213
WordPress File Manager Plugin Remote Code Execution Vulnerability
9.8
CVE-2016-10033
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute…
8.1
CVE-2026-87902
WordPress Core Remote File Inclusion Vulnerability
7.5
CVE-2020-11738
WordPress Snap Creek Duplicator Plugin File Download Vulnerability