The bbPress Notify plugin, a WordPress add‑on that alerts users via email, contains an unfiltered echo of user‑supplied data. An attacker can inject malicious scripts into the plugin’s output, resulting in a reflected cross‑site scripting vulnerability.

Patched versions are available for bbPress Notify > 2.19.5. The vulnerability affects all installations of the plugin through version 2.19.5, regardless of other WordPress plugins or themes. The problem resides solely in the plugin itself.

The flaw is quantified with a CVSS score of 7.1, which signals a high‑severity risk to confidentiality, integrity, and availability. The EPSS score is less than 1 %, indicating that exploitation is unlikely given current threat activity, and it is not listed in CISA’s KEV database. Attackers would send a crafted URL or form that includes malicious JavaScript, which the plugin fails to escape, allowing code execution in the victim’s browser.