315 matches found
WordPress BBPress 2.5 Privilege Escalation
Exploit Title: Wordpress Plugin BBPress 2.5 - Unauthenticated Privilege Escalation Date: 2020-05-29 Exploit Author: Raphael Karger Software Link: https://codex.bbpress.org/releases/ Version: BBPress 2.5 CVE: CVE-2020-13693 import argparse import requests import bs4 import urllib3...
CVE-2020-13693
An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled...
CVE-2020-13693
An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled...
Privilege escalation
An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled...
WordPress bbPress Elevation of Privilege Vulnerability
WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. bbPress is a forum plugin that is used in it. A security vulnerability exists in WordPress bbPress versions prior to 2.6.5. An...
WordPress bbPress plugin <= 2.6.4 - Unauthenticated Privilege Escalation vulnerability
Unauthenticated Privilege Escalation vulnerability discovered by Raphael Karger in WordPress bbPress plugin versions = 2.6.4. Solution Update the WordPress bbPress plugin to the latest available version at least 2.6.5...
CVE-2020-13693
An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled...
CVE-2020-13693
The CVE-2020-13693 entry concerns the WordPress bbPress plugin before 2.6.5, where an unauthenticated privilege-escalation vulnerability exists when New User Registration is enabled. The issue stems from a privilege escalation path in bbPress that allows attackers without authentication to gain h...
WordPress bbPress plugin <= 2.6.4 - Authenticated Privilege Escalation vulnerability
Authenticated Privilege Escalation vulnerability discovered by hoangkien1020 in WordPress bbPress plugin versions = 2.6.4. Solution Update the WordPress bbPress plugin to the latest available version at least 2.6.5...
bbPress < 2.6.5 - Authenticated Stored Cross-Site Scripting via the forums list table
binit discovered a stored XSS issue via the forums list table. The payload is put and can only be triggered by accounts with the Keymaster bbPress role...
bbPress 2.6-2.6.5 - Authenticated Privilege Escalation via the Super Moderator feature
hoangkien1020 discovered an authenticated privilege escalation issue via the super moderator feature...
bbPress < 2.6.5 - Unauthenticated Privilege Escalation when New User Registration enabled
Raphael Karger discovered an unauthenticated privilege escalation issue when new user registration is enabled...
WordPress bbPress plugin cross-site scripting vulnerability
WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. bbPress is a forum plugin used in it. A cross-site scripting vulnerability exists in WordPress bbPress plugin 2.6.4 and...
CVE-2020-13487
The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?posttype=forum aka the Forum listing page for all users. An administrator can exploit this at the wp-admin/post.php?action=edit URI...
CVE-2020-13487
The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?posttype=forum aka the Forum listing page for all users. An administrator can exploit this at the wp-admin/post.php?action=edit URI...
Design/Logic Flaw
The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?posttype=forum aka the Forum listing page for all users. An administrator can exploit this at the wp-admin/post.php?action=edit URI...
CVE-2020-13487
The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?posttype=forum aka the Forum listing page for all users. An administrator can exploit this at the wp-admin/post.php?action=edit URI...
CVE-2020-13487
The vulnerability is in the bbPress WordPress plugin up to version 2.6.4, where stored XSS exists in the Forum creation section. The issue allows JavaScript execution in the admin interface (wp-admin/edit.php?post_type=forum) and is exploitable by an administrator via the wp-admin/post.php?action...
WordPress: Authenticated Stored Cross-site Scripting in bbPress
Description: There exists a stored XSS vulnerability in bbPress, due to which the XSS payload which I enter in my content, gets executed at /wp-admin/edit.php?posttype=forum. This vulnerability requires you to be an authenticated user. Steps To Reproduce: Step 1. Visit...