GHSA-p9xp-xghp-gqvp
bbPress stored Cross-Site Scripting (XSS) vulnerability in the Forum creation section
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | bbpress/bbpress | <= 2.6.4 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=forum (aka the Forum listing page) for all users. An administrator can exploit this at the wp-admin/post.php?action=edit URI.
References
External links from the advisory. They lead to third-party sites.