bbp style pack, 123a98bce5d99a5ae25ac4914d291f219470c743

CVE, Research URL: 123a98bce5d99a5ae25ac4914d291f219470c743
Home page URL: Security reports for bbp style pack
Application: bbp style pack
Published on: Sep 28, 2023
Research Description: bbp style pack [bbp-style-pack] < 5.6.8 bbp style pack <= 5.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'display-top-users' shortcode in versions up to, and including, 5.6.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 5.6.8.
Status: vulnerable