
BuddyBoss Platform Stored XSS via Group Name (CVE-2026-96554)
CVE-2026-96554 lets a Subscriber plant a script through a BuddyBoss group name when member group creation is on, which is the default. How to check, mitigate, update and look for signs of misuse.



