Vulnerabilities

TI-2026-22097 CVE-2026-27737

BigBlueButton has Stored XSS in bbb-playback replay

LOW 28

BigBlueButton is an open-source virtual classroom.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00257 Published 2026-05-18 Fixed in 3.0.19, 1.7.0 +1 CWE-79

TI-2023-06666 CVE-2023-7296 · GHSA-cxgh-hg8w-qcg5

BigBlueButton <= 3.0.0-beta.4 - Authenticated (Author+) Stored Cross-Site Scripting

LOW 28

The BigBlueButton plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the moderator code and viewer code fields in versions up to, and including, 3.0.0-beta.4 due to insufficient input sanitization…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0029 Published 2024-10-16 No fix listed CWE-79

TI-2023-20883 CVE-2023-39991 · GHSA-fxwp-phjw-33xf

WordPress BigBlueButton Plugin <= 3.0.0-beta.4 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Blindside Networks BigBlueButton plugin <= 3.0.0-beta.4 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00374 Published 2023-09-04 No fix listed CWE-79

Vulnerabilities

Filters

BigBlueButton has Stored XSS in bbb-playback replay

BigBlueButton <= 3.0.0-beta.4 - Authenticated (Author+) Stored Cross-Site Scripting

WordPress BigBlueButton Plugin <= 3.0.0-beta.4 is vulnerable to Cross Site Scripting (XSS)