GHSA-p9xp-xghp-gqvpmedium4.8
bbPress stored Cross-Site Scripting (XSS) vulnerability in the Forum creation section
The advisory, in context
The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=forum (aka the Forum listing page) for all users. An administrator can exploit this at the wp-admin/post.php?action=edit URI.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
bbpress/bbpress Packagist
Ecosystem versions
Earlier releases through 2.6.4 (inclusive)
No fix recorded for this interval.
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.6.4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": []
}