CVE-2026-4653 describes a stored cross-site scripting vulnerability in the Block, Suspend, Report for BuddyPress plugin for WordPress. The flaw exists in the handling of the 'link' parameter, allowing authenticated attackers with subscriber-level privileges or higher to inject arbitrary web scripts. These scripts are stored and executed when users access the injected pages. The vulnerability is due to improper neutralization of input during web page generation (CWE-79). The affected versions are all versions up to and including 3.6.4. The CVSS 3.1 base score is 6.4, indicating a medium severity vulnerability with network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality and integrity but not availability.

An attacker with subscriber-level access or higher can inject persistent malicious scripts via the 'link' parameter. These scripts execute in the context of users who view the affected pages, potentially leading to theft of credentials, session hijacking, or other actions depending on the script. The vulnerability impacts confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's communications for updates. As a temporary measure, restrict subscriber-level users from submitting untrusted input in the 'link' parameter if possible, and consider applying web application firewall (WAF) rules to detect and block suspicious input. Avoid granting unnecessary privileges to users until a fix is available.