Bigbluebutton Vulnerabilities

[en] The BigBlueButton plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the moderator code and viewer code fields in versions up to, and including, 3.0.0-beta.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with author privileges...

Affected:

up to 3.0.0-beta.4

Fix:

No patched version reported

Disclosed:

Oct 16, 2024

CVE-2023-7296 on NVD →

[en] Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Blindside Networks BigBlueButton plugin <= 3.0.0-beta.4 versions.

Affected:

up to 3.0.0-beta.4

Fix:

No patched version reported

Disclosed:

Sep 4, 2023

CVE-2023-39991 on NVD →

No patched version available. Marco Wotschka discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress BigBlueButton Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when g...

Affected:

up to 3.0.0-beta.4

Fix:

No patched version reported

Disclosed:

Aug 18, 2023

The BigBlueButton plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the moderator code and viewer code fields in versions up to, and including, 3.0.0-beta.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with author privileges or hi...

CVSS:

6.4

Affected:

up to 3.0.0-beta.4

Fix:

No patched version reported

Disclosed:

Aug 17, 2023

CVE-2023-7296 on NVD →

The BigBlueButton plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the moderator code and viewer code fields in versions up to, and including, 3.0.0-beta.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with author privileges or hi...

Affected:

up to 3.0.0-beta.4

Fix:

No patched version reported

Disclosed:

Aug 17, 2023

The BigBlueButton plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the username and temp_entry_pass parameters in versions up to, and including, 3.0.0-beta.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web s...

CVSS:

6.1

Affected:

up to 3.0.0-beta.4

Fix:

No patched version reported

Disclosed:

Aug 9, 2023

CVE-2023-39991 on NVD →

[en] BigBlueButton before 2.2.4 allows XSS via closed captions because dangerouslySetInnerHTML in React is used.

Affected:

up to 2.2.4

Fixed in:

2.2.4

Disclosed:

Apr 23, 2020

CVE-2020-12113 on NVD →