The bbPress Move Topics plugin contains an improper neutralization of input flaw that permits reflected cross‑site scripting, identified as CWE‑79. A malicious actor can deliver crafted input that is echoed into the page without proper escaping, enabling the injection of JavaScript code that executes in the victim’s browser. This can lead to theft of credentials, session hijacking, defacement, or the delivery of phishing content to users visiting the affected WordPress site.

The vulnerability is present in Pascal Casier’s bbPress Move Topics plugin for WordPress, affecting all versions up to and including 1.1.6. Users running this plugin without the latest fix are exposed.

With a CVSS base score of 7.1, the flaw is considered high severity. The EPSS score of less than 1% indicates a very low probability of current exploitation, and it is not listed in the CISA KEV catalog. The likely attack vector is a reflected XSS scenario whereby an attacker must entice a user to click a malicious link or visit a crafted URL that is processed by the vulnerable plugin. No authentication or privileged conditions are required, so any visitor can be affected.