Description
The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name (via /wp-admin/profile.php) + bbp_reply_content (via bbPress reply form)' parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the attacker to wrap their crafted reply in a <pre> block, which prevents WordPress's wpautop/wptexturize processors from converting straight double quotes in the stored display name into typographic curly-quote entities that would otherwise neutralize the attribute-injection.
Published: 2026-10-01
Score: 6.4 Medium
EPSS: n/a
KEV: No
Impact: Stored Cross‑Site Scripting
Action: Patch
AI Analysis

Impact

The plugin contains insufficient input sanitization and output escaping around the user's display name and reply content, allowing an authenticated user with subscriber level or higher to store malicious scripts that are rendered when another user views a page. The malicious scripts are executed as arbitrary JavaScript within the victim's browser session.

Affected Systems

robin-w's bbp style pack plugin for WordPress, versions up to and including 6.4.8, is affected. Any WordPress installation that has installed the plugin at these versions and grants subscriber‑level access to users is vulnerable.

Risk and Exploitability

The CVSS score is 6.4, indicating a moderate to high severity. EPSS is not available, and the vulnerability is not listed in CISA KEV. Because exploitation requires the attacker to create a reply wrapped in a <pre> tag, the attack vector is authenticated via subscriber‑level actions. The vulnerability can be leveraged after gaining authenticated access sufficient to edit profile display names and submit replies, which is commonly possible for a wide range of users on typical WordPress sites.

Generated by OpenCVE AI on October 1, 2026 at 11:59 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade bbp style pack to version 6.4.9 or higher.
  • Limit subscriber permissions so they cannot edit display names or submit replies, for example by removing the ability to edit profile information and creating custom role restrictions.
  • If an immediate upgrade is not feasible, block script tags in bbPress reply content with a WAF rule or remove the reply feature entirely, and consider disabling profile display name editing for non‑admin users.

Generated by OpenCVE AI on October 1, 2026 at 11:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 01 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 01 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Robin-w
Robin-w bbp Style Pack
Wordpress-extensions
Wordpress-extensions bbp Style Pack
Vendors & Products Robin-w
Robin-w bbp Style Pack
Wordpress-extensions
Wordpress-extensions bbp Style Pack

Thu, 01 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Description The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name (via /wp-admin/profile.php) + bbp_reply_content (via bbPress reply form)' parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the attacker to wrap their crafted reply in a &lt;pre&gt; block, which prevents WordPress's wpautop/wptexturize processors from converting straight double quotes in the stored display name into typographic curly-quote entities that would otherwise neutralize the attribute-injection.
Title bbp style pack <= 6.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Author Display Name
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Robin-w Bbp Style Pack
Wordpress-extensions Bbp Style Pack
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-10-01T18:21:22.142Z

Reserved: 2026-09-28T16:04:07.165Z

Link: CVE-2026-101925

cve-icon Vulnrichment

Updated: 2026-10-01T18:21:18.972Z

cve-icon NVD

Status : Deferred

Published: 2026-10-01T09:17:07.563

Modified: 2026-10-01T19:17:16.993

Link: CVE-2026-101925

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T15:36:03Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')