Vulnerabilities and security researches forbbp-core bbp-core

Jun 07, 2024

CVE, Research URL: 669aaf662628480b7e9ed5c0e9ec88860ecac0eb
Home page URL: Security reports for BBP Core – Expand bbPress powered forums with useful features
Application: BBP Core – Expand bbPress powered forums with useful features
Date: Jul 18, 2023
Research Description: BBP Core – Expand bbPress powered forums with useful features [bbp-core] < 1.2.0 WordPress BBP Core - Expand bbPress powered forums with useful features Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS) No patched version available. Rafie Muhammad (Patchstack) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress BBP Core - Expand bbPress powered forums with useful features Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.
Affected versions: max 1.2.0.
Status: vulnerable

Nov 03, 2024

CVE, Research URL: CVE-2024-9896
Home page URL: Security reports for BBP Core – Expand bbPress powered forums with useful features
Application: BBP Core – Expand bbPress powered forums with useful features
Date: Nov 02, 2024
Research Description: The BBP Core – Expand bbPress powered forums with useful features plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected versions: max 1.2.6.
Status: vulnerable

Jan 10, 2026

CVE, Research URL: CVE-2025-68572
Home page URL: Security reports for BBP Core – Expand bbPress powered forums with useful features
Application: BBP Core – Expand bbPress powered forums with useful features
Date: Dec 24, 2025
Research Description: Missing Authorization vulnerability in Spider Themes BBP Core bbp-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BBP Core: from n/a through <= 1.4.1.
Affected versions: max 1.4.1.
Status: vulnerable