The GD bbPress Tools WordPress plugin contains a DOM‑based cross‑site scripting flaw that results from improper neutralization of user input during web page rendering. This vulnerability allows an attacker to inject arbitrary JavaScript into a victim’s browser. Based on the description, it is inferred that such an attacker could hijack sessions, perform phishing attacks, or deface the site, thereby compromising the confidentiality and integrity of the web application.

Any installation of the Milan Petrovic GD bbPress Tools plugin for WordPress running version 3.5.3 or earlier is affected. No specific sub‑versions are listed, so all releases up to and including 3.5.3 should be considered vulnerable.

A potential attacker can trigger the flaw by delivering malicious input via a crafted URL or form submission. Based on the description, it is inferred that authentication is not required to exploit the vulnerability, although this is not explicitly stated. The CVSS score of 6.5 reflects a moderate severity, while the EPSS score of less than 1 % indicates a low probability that exploit code is currently used in the wild. The vulnerability is not present in CISA KEV. Exploitation would rely on the victim’s browser processing the injected payload, which could enable session hijacking or other client‑side attacks.