The bbp Style Pack plugin for WordPress allows authenticated users with Subscriber (or higher) access to inject arbitrary JavaScript into the "Topic Form Additional Fields" meta values because the input is not sanitized before being stored and is later output without proper escaping. This flaw is a classic example of CWE‑79 and gives attackers the ability to deface the site, steal cookies, or hijack user sessions from any page that displays the vulnerable topic.

WordPress sites running bbp Style Pack version 6.4.5 or earlier and that have bbPress topic‑creation capabilities enabled for the Subscriber role are affected. Administrators, Editors, and other privileged roles that can create topics also possess the necessary rights to abuse the vulnerability, but the flaw specifically requires at least Subscriber-level privileges.

The CVSS score of 6.4 reflects a moderate severity that stems from the authentication requirement but wide cross‑site impact. The EPSS score is below 1 %, indicating that exploitation is currently unlikely, and the flaw is not listed in the CISA KEV catalog, so no widespread attacks have been reported. The attack vector is via the WordPress admin interface; an attacker submits a topic with malicious content, storing the payload in post meta, which is rendered in a span element on the topic page. Once stored, any visitor to the topic page, including unauthenticated users, will have the injected script executed.