The bbpress Simple Advert Units plugin for WordPress does not properly neutralize user input that is rendered in a web page, creating a reflected Cross‑Site Scripting flaw. A malicious actor can craft input that is sent to the plugin, which is then reflected unfiltered back to the browser and executed as JavaScript. This could allow the attacker to steal session tokens, deface the page, or perform other malicious actions within the victim’s browser context.

Any WordPress site that has installed the jezza101 bbpress Simple Advert Units plugin version 0.41 or earlier is vulnerable. The flaw exists in all installations regardless of the visitor’s role, because the vulnerable input is reflected for every request that includes the plugin’s input fields.

The CVSS score of 7.1 indicates high severity, while an EPSS score of less than 1 % suggests a low probability of exploitation. The vulnerability is not currently listed in the CISA KEV catalog. The most likely attack vector involves injecting malicious input into the plugin’s public parameters, which is then returned to the victim’s browser and executed. Successful exploitation would provide the attacker with the ability to run arbitrary JavaScript in the context of the victim’s session, potentially enabling credential theft, hijacking, or defacement.