Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The BuddyPress Community BuddyPress allows Stored XSS.This issue affects BuddyPress: from n/a through 11.3.1.
BuddyPress is an open source WordPress plugin to build a community site. In vulnerable releases of BuddyPress, it's possible for a non-privileged, regular user to obtain administrator rights by exploiting an issue in the REST API members endpoint
In BuddyPress, requests to a certain REST API endpoint can result in private user data getting exposed. Authentication is not needed.
An issue was discovered in includes/component. It is possible for authenticated users to edit documents of other users without proper permissions.