CVE-2026-4653 is a stored cross-site scripting vulnerability in the Block, Suspend, Report for BuddyPress plugin for WordPress. The vulnerability exists due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of the 'link' parameter. Authenticated attackers with subscriber-level privileges or higher can exploit this to inject arbitrary web scripts that execute in the context of other users viewing the injected content. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required. The vulnerability affects versions up to and including 3.6.4, though exact affected versions are not explicitly listed in the input data.

An attacker with subscriber-level access or higher can inject persistent malicious scripts via the 'link' parameter. These scripts execute in the browsers of users who view the affected pages, potentially leading to theft of user credentials, session tokens, or other sensitive information accessible in the browser context. The vulnerability does not impact availability but compromises confidentiality and integrity to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, restrict subscriber-level user privileges where possible and monitor for suspicious activity related to the plugin. Avoid using the vulnerable plugin version if feasible.