bbp Style Pack CVE-2026-101925

Requires an authenticated WordPress account with subscriber-level access or above (PR:L) on a site running bbp style pack ≤6.4.8 with bbPress forums active. The attacker must (1) store the attribute-injection payload in their display_name via /wp-admin/profile.php and (2) submit a bbPress reply with the crafted content wrapped in a <pre> block - this wrapping is mandatory because it prevents WordPress's wpautop/wptexturize processors from converting the straight double-quotes in the stored display name into typographic curly-quote entities, which would otherwise neutralize the attribute injection. Execution occurs when any user views the injected forum/profile page (no interaction needed to plant it; viewing triggers it). Limiting factors: authentication requirement, dependency on bbPress being installed and the display_name being rendered in the quote/reply context, and the precise <pre>-block formatting needed to bypass text sanitization.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N = 6.4 Medium) describes a network-reachable stored XSS that requires only subscriber-level authentication (PR:L) and no victim interaction to inject (UI:N), with a scope change (S:C) reflecting script execution in other users' browser security contexts and low confidentiality/integrity impact. No EPSS score, CISA KEV listing, SSVC decision data, or public proof-of-concept is present in the supplied intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Real-world risk is moderate-but-constrained: exploitation is gated behind an authenticated account AND a non-trivial technical precondition (the payload must be wrapped in a <pre> block to stop WordPress's wpautop/wptexturize from curly-quoting the double-quotes that carry the attribute injection), which raises the practical attack complexity above the AC:L rating the vector assigns. This is a genuine but not emergency-priority issue - a classic high-prevalence-platform, low-impact-per-instance stored XSS rather than a widely-weaponized flaw; the AC:L metric arguably understates the real difficulty given the documented quote-preservation requirement.

A low-privileged subscriber sets a malicious display_name containing an attribute-injection payload via /wp-admin/profile.php, then posts a bbPress reply whose content is wrapped in a <pre> block so WordPress's text processors preserve the straight double-quotes rather than converting them to curly-quote entities. When any user - including an administrator - views the thread or profile page, the stored script executes in their browser session. No public proof-of-concept is identified in the supplied data.