Summary: A Cross‑Site Scripting (XSS) vulnerability (CVE‑2025‑62760) was disclosed in the WordPress plugin “BuddyPress Activity Shortcode” affecting versions ≤ 1.1.8. This advisory explains the issue, realistic impacts, exploitation scenarios, detection and mitigation steps for site owners and developers, and practical defensive measures.

Overview

On 31 December 2025 a Cross‑Site Scripting (XSS) vulnerability was publicly disclosed in the WordPress plugin “BuddyPress Activity Shortcode” affecting all versions up to and including 1.1.8 (CVE‑2025‑62760). The vulnerability allows an attacker with contributor‑level privileges to craft content that is rendered to other users and may include executable JavaScript. Because exploitation requires someone to view or interact with the crafted content, many installations will see a medium/low severity rating — however community sites and membership sites can experience meaningful business and technical impact.

This advisory is written in a practical, technical tone for site owners and developers. It focuses on immediate risk reduction and sound remediation steps.

Why this matters for WordPress community sites

BuddyPress and plugins that extend its activity stream are commonly used to power social/community functionality: activity feeds, member posts, user wall entries, and shortcodes that render that activity in pages or widgets. Community sites commonly accept posts from lower‑privileged accounts (contributors, registered members) and often have significant public traffic.

An XSS vulnerability in an activity shortcode is dangerous because:

• It can serve malicious JavaScript to many visitors (stored XSS) or to specific privileged users.
• It can be used for session theft, to perform actions in the victim’s browser, to inject phishing UI, or to escalate other attacks.
• Community sites typically have many registered users; a widely viewed page could amplify impact quickly.

Even when user interaction is required (clicking a crafted link), attackers commonly use social engineering combined with site trust to obtain that interaction.

Technical details (what XSS means here)

Cross‑Site Scripting (XSS) results from untrusted input being rendered into a page without adequate encoding or filtering. Variants include stored, reflected and DOM XSS. The vulnerability here appears to involve the plugin rendering user‑supplied content (or shortcode attributes) into the page DOM without proper escaping, allowing injected script to execute when other users load the page.

Key technical metadata:

• Affected product: BuddyPress Activity Shortcode plugin
• Affected versions: ≤ 1.1.8
• Vulnerability: Cross‑Site Scripting (XSS)
• CVE: CVE‑2025‑62760
• Required privilege to trigger: Contributor (low‑privileged authenticated users)
• User interaction: Required (victim loads/clicks malicious content)
• Example CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L — illustrative only

Note: Exploitability depends on how the plugin inserts user content into the page, whether CSP or other mitigations are present, and the privileges of target users on your site.

Exploitation scenarios and attacker goals

Realistic attacker scenarios include:

• Stored XSS to site visitors: A contributor submits activity content with a crafted
  Review My Order

  0

  Subtotal

  Taxes & shipping calculated at checkout

  Checkout