CVE-2026-15010
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The bbp Style Pack plugin for WordPress up to version 6.4.5 contains a stored XSS vulnerability. The bsp_topic_fields_form_save() function writes unsanitized input to post meta, and bsp_topic_content_append_topic_fields() outputs it without HTML encoding. Authenticated attackers with Subscriber-level access can inject arbitrary scripts that execute when any user visits the affected page.
Risk Assessment
An attacker can inject malicious JavaScript that executes in browsers of all visitors, including unauthenticated users. This can lead to session hijacking, redirection to malicious sites, or theft of sensitive data.
Recommendation
Immediately update the bbp Style Pack plugin to the latest available version that fixes this vulnerability. If an update is not possible, temporarily disable the Topic Form Additional Fields feature.
Other vulnerabilities in bbp Style Pack
Original NVD description (English source)
The bbp Style Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.4.5 via the Topic Form Additional Fields feature. This is due to insufficient input sanitization in bsp_topic_fields_form_save() (which writes $_POST['bsp_topic_fields_label{n}'] directly to post meta via update_post_meta() with no filtering) and missing output escaping in bsp_topic_content_append_topic_fields() (which concatenates the stored meta value into an HTML <span> and echoes it via apply_filters/echo without esc_html()). This makes it possible for authenticated attackers, with Subscriber-level access and above (who have bbPress topic-creation privileges), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, including unauthenticated visitors.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS