WordPress bbPress plugin cross-site scripting vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. bbPress is a forum plugin used in it. A cross-site scripting vulnerability exists in WordPress bbPress plugin 2.6.4 and...

CVE-2020-13487

The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?posttype=forum aka the Forum listing page for all users. An administrator can exploit this at the wp-admin/post.php?action=edit URI...

CVE-2020-13487

The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?posttype=forum aka the Forum listing page for all users. An administrator can exploit this at the wp-admin/post.php?action=edit URI...

Design/Logic Flaw

The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?posttype=forum aka the Forum listing page for all users. An administrator can exploit this at the wp-admin/post.php?action=edit URI...

CVE-2020-13487

The vulnerability is in the bbPress WordPress plugin up to version 2.6.4, where stored XSS exists in the Forum creation section. The issue allows JavaScript execution in the admin interface (wp-admin/edit.php?post_type=forum) and is exploitable by an administrator via the wp-admin/post.php?action...

CVE-2020-13487

The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?posttype=forum aka the Forum listing page for all users. An administrator can exploit this at the wp-admin/post.php?action=edit URI...

CVE-2020-13487: Improper Neutralization of Input During Web Page Generation

The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?posttype=forum aka the Forum listing page for all users. An administrator can exploit this at the wp-admin/post.php?action=edit URI...

WordPress: Authenticated Stored Cross-site Scripting in bbPress

Description: There exists a stored XSS vulnerability in bbPress, due to which the XSS payload which I enter in my content, gets executed at /wp-admin/edit.php?posttype=forum. This vulnerability requires you to be an authenticated user. Steps To Reproduce: Step 1. Visit...

CVE-2011-1150

bbPress through 1.0.2 has XSS in /bb-login.php url via the re parameter...

Design/Logic Flaw

bbPress through 1.0.2 has XSS in /bb-login.php url via the re parameter...

CVE-2011-1150

bbPress 1.0.2 and earlier contains a Cross‑Site Scripting (XSS) vulnerability in the bb-login.php endpoint, exploitable through the re parameter. The issue is documented across multiple sources (e.g., CVE-2011-1150, Red Hat advisory, GHSA). The connected documents confirm the vulnerability type a...

CVE-2011-1150

bbPress through 1.0.2 has XSS in /bb-login.php url via the re parameter...

CVE-2011-1150: Improper Neutralization of Input During Web Page Generation

bbPress through 1.0.2 has XSS in /bb-login.php url via the re parameter...

WordPress bbPress Members Only plugin <= 1.2.1 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found in WordPress bbPress Members Only plugin versions = 1.2.1. Solution Update the WordPress bbPress Members Only plugin to the latest available version at least 1.3.1...

WordPress bbPress Login Register Links On Forum Topic Pages plugin <= 2.7.5 - Cross-Site Request Forgery (CSRF) to Stored Cross-Site Scripting (XSS) vulnerability

CSRF to Stored XSS vulnerability found in WordPress bbPress Login Register Links On Forum Topic Pages plugin versions = 2.7.5. Solution Update the WordPress bbPress Login Register Links On Forum Topic Pages plugin to the latest available version at least 2.8.5...

bbPress Members Only <= 1.2.1 - CSRF on Optional Settings page

The plugin does not prevent Cross-Site Request Forgery attacks on its 'Optional Settings' page. PoC...

bbPress Members Only <= 1.2.1 - CSRF on Optional Settings page

The plugin does not prevent Cross-Site Request Forgery attacks on its 'Optional Settings' page...

WordPress bbPress Members Only Plugin Cross Site Request Forgery Vulnerability

Description The 'bbPress Members Only' Plugin for WordPress is prone to a cross-site request-forgery vulnerability. An attacker can exploit this issue to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible. The 'bbPress Members Only'...

bbPress Login Register Links On Forum Topic Pages <= 2.7.5 - CSRF to Stored XSS

Lack of CSRF checks in the plugin's settings allow arbitrary change of the settings, which can also lead to stored XSS issues. PoC The payload below will result in a stored XSS in the 'Style Customize' page...

bbPress Login Register Links On Forum Topic Pages <= 2.7.5 - CSRF to Stored XSS

Lack of CSRF checks in the plugin's settings allow arbitrary change of the settings, which can also lead to stored XSS issues. The payload below will result in a stored XSS in the 'Style Customize' page. " /...