Vulnerabilities and security researches forbbpress-post-topics bbpress-post-topics

Jun 07, 2024

CVE, Research URL: c68aa4ff98c986382405d4926b06aba90b3d33a1
Home page URL: Security reports for Post Comments as bbPress Topics
Application: Post Comments as bbPress Topics
Date: Jun 22, 2022
Research Description: Post Comments as bbPress Topics [bbpress-post-topics] < 2.2.4 Post Comments as bbPress Topics <= 2.2.3 - Authenticated (Author+) Stored Cross-Site Scripting The Post Comments as bbPress Topics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via various parameters, such as `bbpress_topic[display-extras][xcount]` in versions up to, and including, 2.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with publishing capabilities, to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected versions: max 2.2.4.
Status: vulnerable