CVE-2024-3974 – This stored XSS vulnerability in BuddyPress all... (How to Fix)

Q: What is the severity of CVE-2024-3974?

CVE-2024-3974 has a CVSS score of 6.4 (MEDIUM). This stored XSS vulnerability in BuddyPress allows authenticated users with subscriber-level permissions or higher to inject malicious scripts into web pages via the 'user_name' parameter. The injected scripts execute whenever other users view the compromised pages, potentially affecting all WordPress sites running vulnerable BuddyPress versions.

📋 TL;DR

This stored XSS vulnerability in BuddyPress allows authenticated users with subscriber-level permissions or higher to inject malicious scripts into web pages via the 'user_name' parameter. The injected scripts execute whenever other users view the compromised pages, potentially affecting all WordPress sites running vulnerable BuddyPress versions.

💻 Affected Systems

Products:

BuddyPress WordPress Plugin

Versions: All versions up to and including 12.4.0

Operating Systems: All operating systems running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: All WordPress installations with BuddyPress plugin enabled are vulnerable. The vulnerability requires authenticated access but only at subscriber level, which is the lowest user role.

📦 What is this software?

Buddypress by Buddypress

View all CVEs affecting Buddypress →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal session cookies, redirect users to malicious sites, deface websites, or perform actions on behalf of authenticated users, potentially leading to complete site compromise.

🟠

Likely Case

Attackers will typically inject scripts to steal user session cookies or credentials, potentially gaining administrative access to the WordPress site.

🟢

If Mitigated

With proper input validation and output escaping, the attack would be prevented, and only sanitized data would be displayed to users.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access but only at subscriber level. The vulnerability is well-documented with public references showing the exact code locations.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 12.4.1 and later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3079691/buddypress

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find BuddyPress and click 'Update Now'. 4. Alternatively, download version 12.4.1+ from WordPress.org and manually update.

🔧 Temporary Workarounds

Disable BuddyPress Plugin

all

Temporarily disable the BuddyPress plugin until patching is possible

wp plugin deactivate buddypress

Restrict User Registration

all

Disable new user registration to prevent attackers from creating subscriber accounts

wp option update users_can_register 0

🧯 If You Can't Patch

Implement web application firewall (WAF) rules to block XSS payloads in user_name parameter
Restrict user registration and review existing subscriber accounts for suspicious activity

🔍 How to Verify

Check if Vulnerable:

Check BuddyPress version in WordPress admin under Plugins → Installed Plugins or run: wp plugin get buddypress --field=version

Check Version:

wp plugin get buddypress --field=version

Verify Fix Applied:

Verify BuddyPress version is 12.4.1 or higher using: wp plugin get buddypress --field=version

📡 Detection & Monitoring

Log Indicators:

Unusual user_name parameter values containing script tags or JavaScript in WordPress/BuddyPress logs
Multiple failed login attempts followed by successful subscriber-level logins

Network Indicators:

HTTP requests containing script payloads in user_name parameter
Outbound connections to suspicious domains from your WordPress server

SIEM Query:

source="wordpress.log" AND ("user_name" AND ("<script" OR "javascript:" OR "onload=" OR "onerror="))

📊 Metadata

CVE ID: CVE-2024-3974

CVSS v3 Score: 6.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

Published: May 14, 2024

Last Updated: June 5, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-3974, you might also want to check these: