CVE-2026-96554

Name of the Vulnerable Software and Affected Versions BuddyBoss Platform versions prior to 3.6.1

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts into pages. These scripts execute when a user accesses the affected page. This issue is exploitable when the "Enable social group creation by all members" setting is active, allowing subscriber-level users to create groups.

Recommendations Update BuddyBoss Platform to version 3.6.1 or later. Restrict group creation to administrators to prevent exploitation.