BU Section Editing
BU Section Editing has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2024; none of them are fixed as of October 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10. 2024 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).
None of the 2 issues recorded for BU Section Editing have a published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2024.
2 independent researchers contributed these findings, one record each. BU Section Editing is installed on roughly 50 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.4.
CVE-2024-12736BU Section Editing <= 0.9.9 - Reflected Cross-Site Scripting
Read the full analysisVulnerability Records

BU Section Editing
Author
BU Web Team
BU Section Editing provides advanced permissions for managing the editors on your website team. Create “section editing groups” and granularly control who can edit what content. Assign editors the new Section Editor role, and define what the group can edit with an innovative new interface for specifying any of your content – pages, posts, or any custom post types – right down to the single page or single post level. The plugin was written by Boston University IS&T staff with design and UX support from the Interactive Design group in Marketing & Communications. Features Group users with similar editing privileges into “Section Groups” Each section group can have a unique ACL to determine what content is considered editable for group members Supports custom post types Integrations with navigation management views provided by the BU Navigation Plugin For more information check out http://developer.bu.edu/bu-section-editing/. Developers For developer documentation, feature roadmaps and more visit the plugin repository on Github.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C