6 matches found
CVE-2026-101925
The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname via /wp-admin/profile.php + bbpreplycontent via bbPress reply form' parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This make...
EUVD-2026-90567
The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname via /wp-admin/profile.php + bbpreplycontent via bbPress reply form' parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This make...
CVE-2026-101925 bbp style pack <= 6.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Author Display Name
The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname via /wp-admin/profile.php + bbpreplycontent via bbPress reply form' parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This make...
CVE-2026-101925
The bbp style pack plugin for WordPress (versions up to and including 6.4.8 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the display_name (via /wp-admin/profile.php) and bbp_reply_content (via bbPress reply form) p...
CVE-2026-101925 bbp style pack <= 6.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Author Display Name
The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname via /wp-admin/profile.php + bbpreplycontent via bbPress reply form' parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This make...
CVE-2026-101925: Improper Neutralization of Input During Web Page Generation
The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname via /wp-admin/profile.php + bbpreplycontent via bbPress reply form' parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This make...