GHSA-p9xp-xghp-gqvpMediumCVSS 4.8

bbPress stored Cross-Site Scripting (XSS) vulnerability in the Forum creation section

Published
May 24, 2022
Last Modified
April 25, 2024

🔗 CVE IDs covered (1)

CVE-2020-13487 →

📋 Description

The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=forum (aka the Forum listing page) for all users. An administrator can exploit this at the wp-admin/post.php?action=edit URI.

🎯 Affected products1

  • composer/bbpress/bbpress:<= 2.6.4

🔗 References (6)