Improper neutralization of input in the bbPress2 shortcode whitelist plugin leads to a stored cross‑site scripting vulnerability. The flaw allows an attacker to embed malicious JavaScript in a shortcode, which is then rendered when other users view the content. Successful exploitation can execute arbitrary scripts in the victim’s browser, enabling session hijacking, credential theft, defacement, or further lateral movement.

Vulnerable versions of the WordPress plugin antonchanning bbPress2 shortcode whitelist (commonly known as bbPress2 shortcode whitelist) from the initial release through version 2.2.1 are affected. Any WordPress site running one of these versions of the plugin is at risk.

With a CVSS score of 7.1, the vulnerability is considered moderate to high in severity, while its EPSS score of less than 1 % indicates a currently low probability of exploitation in the wild. The issue is not listed in the CISA KEV catalog. An attacker could exploit the flaw by submitting malicious shortcodes through the plugin’s interface—typically requiring authenticated access but circumventable via a CSRF attack. The stored payload then executes in the context of all users who view the affected content.