The BuddyBoss Platform WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) via the 'bbp_topic_title' parameter. This vulnerability allows authenticated users with at least Subscriber privileges to inject arbitrary web scripts due to insufficient input sanitization and output escaping. The issue affects all versions up to and including 2.8.50, with a partial fix applied in version 2.8.41. The CVSS 3.1 base score is 6.4, reflecting a network attack vector, low attack complexity, required privileges at the low level, no user interaction needed, and impacts on confidentiality and integrity with no availability impact. No official patch or remediation link is provided, and no known exploits have been reported.

An attacker with Subscriber-level access or higher can inject malicious scripts into pages via the vulnerable parameter, potentially leading to unauthorized actions or data exposure when other users view those pages. The impact affects confidentiality and integrity but not availability. The vulnerability is partially mitigated in version 2.8.41 but remains exploitable in versions up to 2.8.50.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since a partial patch was introduced in version 2.8.41 but the vulnerability persists through 2.8.50, users should monitor for an official fix from the vendor. Until an official fix is available, restrict Subscriber-level user capabilities if possible and consider additional input validation or output escaping controls at the application or web server level.