Vulnerabilities and security researches forbbp-style-pack bbp-style-pack

Jun 07, 2024

CVE, Research URL: CVE-2023-44984
Home page URL: Security reports for bbp style pack
Application: bbp style pack
Date: Oct 16, 2023
Research Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Robin Wilson bbp style pack plugin <= 5.6.7 versions.
Affected versions: max 5.6.8.
Status: vulnerable

CVE, Research URL: 9bce95fd51553cab6526ad40cf2a7a99cef6cfcd
Home page URL: Security reports for bbp style pack
Application: bbp style pack
Date: May 30, 2023
Research Description: bbp style pack [bbp-style-pack] < 5.5.6 bbp style pack <= 5.5.5 - Reflected Cross-Site Scripting The bbp style pack plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via an unknown parameter in versions up to, and including, 5.5.5 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 5.5.6.
Status: vulnerable

CVE, Research URL: CVE-2023-33997
Home page URL: Security reports for bbp style pack
Application: bbp style pack
Date: Jun 22, 2023
Research Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Robin Wilson bbp style pack plugin <= 5.5.5 versions.
Affected versions: max 5.5.6.
Status: vulnerable

Jun 16, 2026

CVE, Research URL: 123a98bce5d99a5ae25ac4914d291f219470c743
Home page URL: Security reports for bbp style pack
Application: bbp style pack
Date: Sep 28, 2023
Research Description: bbp style pack [bbp-style-pack] < 5.6.8 bbp style pack <= 5.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'display-top-users' shortcode in versions up to, and including, 5.6.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 5.6.8.
Status: vulnerable

Jul 11, 2026

CVE, Research URL: CVE-2026-15010
Home page URL: Security reports for bbp style pack
Application: bbp style pack
Date: Jul 11, 2026
Research Description: The bbp Style Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.4.5 via the Topic Form Additional Fields feature. This is due to insufficient input sanitization in bsp_topic_fields_form_save() (which writes $_POST['bsp_topic_fields_label{n}'] directly to post meta via update_post_meta() with no filtering) and missing output escaping in bsp_topic_content_append_topic_fields() (which concatenates the stored meta value into an HTML <span> and echoes it via apply_filters/echo without esc_html()). This makes it possible for authenticated attackers, with Subscriber-level access and above (who have bbPress topic-creation privileges), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, including unauthenticated visitors.
Affected versions: max 6.4.6.
Status: vulnerable