410 matches found
CVE-2020-13487: Improper Neutralization of Input During Web Page Generation
The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?posttype=forum aka the Forum listing page for all users. An administrator can exploit this at the wp-admin/post.php?action=edit URI...
PT-2020-13570
Name of the Vulnerable Software and Affected Versions bbPress plugin versions through 2.6.4 Description The issue concerns stored XSS in the Forum creation section of the bbPress plugin, allowing JavaScript execution at the "wp-admin/edit.php?post type=forum" API endpoint, which is the Forum...
WordPress: Authenticated Stored Cross-site Scripting in bbPress
Description: There exists a stored XSS vulnerability in bbPress, due to which the XSS payload which I enter in my content, gets executed at /wp-admin/edit.php?posttype=forum. This vulnerability requires you to be an authenticated user. Steps To Reproduce: Step 1. Visit...
CVE-2011-1150
bbPress through 1.0.2 has XSS in /bb-login.php url via the re parameter...
Design/Logic Flaw
bbPress through 1.0.2 has XSS in /bb-login.php url via the re parameter...
CVE-2011-1150
bbPress 1.0.2 and earlier contains a Cross‑Site Scripting (XSS) vulnerability in the bb-login.php endpoint, exploitable through the re parameter. The issue is documented across multiple sources (e.g., CVE-2011-1150, Red Hat advisory, GHSA). The connected documents confirm the vulnerability type a...
CVE-2011-1150
bbPress through 1.0.2 has XSS in /bb-login.php url via the re parameter...
PT-2020-7094
Name of the Vulnerable Software and Affected Versions bbPress versions 1.0.0 through 1.0.2 Description The issue concerns a cross-site scripting XSS flaw in the /bb-login.php URL, specifically via the re parameter. This allows for potential malicious script injection. No information is provided...
CVE-2011-1150: Improper Neutralization of Input During Web Page Generation
bbPress through 1.0.2 has XSS in /bb-login.php url via the re parameter...
WordPress bbPress Members Only plugin <= 1.2.1 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability found in WordPress bbPress Members Only plugin versions = 1.2.1. Solution Update the WordPress bbPress Members Only plugin to the latest available version at least 1.3.1...
WordPress bbPress Login Register Links On Forum Topic Pages plugin <= 2.7.5 - Cross-Site Request Forgery (CSRF) to Stored Cross-Site Scripting (XSS) vulnerability
CSRF to Stored XSS vulnerability found in WordPress bbPress Login Register Links On Forum Topic Pages plugin versions = 2.7.5. Solution Update the WordPress bbPress Login Register Links On Forum Topic Pages plugin to the latest available version at least 2.8.5...
bbPress Members Only <= 1.2.1 - CSRF on Optional Settings page
The plugin does not prevent Cross-Site Request Forgery attacks on its 'Optional Settings' page. PoC...
bbPress Members Only <= 1.2.1 - CSRF on Optional Settings page
The plugin does not prevent Cross-Site Request Forgery attacks on its 'Optional Settings' page...
WordPress bbPress Members Only Plugin Cross Site Request Forgery Vulnerability
Description The 'bbPress Members Only' Plugin for WordPress is prone to a cross-site request-forgery vulnerability. An attacker can exploit this issue to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible. The 'bbPress Members Only'...
bbPress Login Register Links On Forum Topic Pages <= 2.7.5 - CSRF to Stored XSS
Lack of CSRF checks in the plugin's settings allow arbitrary change of the settings, which can also lead to stored XSS issues. PoC The payload below will result in a stored XSS in the 'Style Customize' page...
bbPress Login Register Links On Forum Topic Pages <= 2.7.5 - CSRF to Stored XSS
Lack of CSRF checks in the plugin's settings allow arbitrary change of the settings, which can also lead to stored XSS issues. The payload below will result in a stored XSS in the 'Style Customize' page. " /...
CVE-2018-21006
The bbp-move-topics plugin before 1.1.6 for WordPress has CSRF...
GD bbPress Attachments <= 2.5 - Authenticated Stored XSS
An authenticated user of a bbPress forum, who can attach a file, can inject arbitrary JavaScript code via the image filename. The arbitrary code runs both on the topic page and in the admin panel, and it only affects the administrators, moderators and the attacker. The variable $error‘file’ in...
WordPress GD bbPress Attachments plugin <=2.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability found by Luigi Gubello in WordPress GD bbPress Attachments plugin versions =2.5. Solution Update the WordPress GD bbPress Attachments plugin to the latest available version at least 2.6...