The BuddyBoss Platform plugin for WordPress contains a stored cross-site scripting vulnerability (CWE-79) in the 'bp_nouveau_ajax_media_save' function due to inadequate input sanitization and output escaping. This allows authenticated users with Subscriber-level privileges or higher to inject arbitrary JavaScript code into pages, which executes when accessed by other users. The vulnerability affects all versions up to 2.8.50, with a partial fix applied in version 2.8.41. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and privileges required. No official patch or vendor advisory with remediation instructions is currently available.

An attacker with authenticated access at Subscriber level or above can inject persistent malicious scripts into the BuddyBoss Platform pages. These scripts execute in the context of other users viewing the injected content, potentially leading to session hijacking, unauthorized actions, or data theft limited to the scope of the injected scripts. The vulnerability does not impact availability and requires user interaction (page access) to trigger. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. A partial patch was introduced in version 2.8.41, but the vulnerability persists through version 2.8.50. Until an official full fix is released, consider restricting Subscriber-level user capabilities or monitoring for suspicious activity related to media saving functions. Avoid upgrading to versions between 2.8.41 and 2.8.50 without confirmation of full remediation. Follow official vendor channels for updates.