EIP-2026-113609

This is a working proof-of-concept for a persistent XSS vulnerability in BuddyPress 6.2.0, where an attacker with moderator privileges can inject malicious script code via the `wp:html` parameter in a `figure` block, which executes when previewed by an admin or privileged user.