EUVD-2026-43165
GHSA-qv97-pgw5-6f6x
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Stored XSS is network-reachable requiring only a Subscriber account (PR:L); Scope:Changed because injected payload executes in unauthenticated third-party visitors' browsers beyond the attacker's own session.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The bbp Style Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.4.5 via the Topic Form Additional Fields feature. This is due to insufficient input sanitization in bsp_topic_fields_form_save() (which writes $_POST['bsp_topic_fields_label{n}'] directly to post meta via update_post_meta() with no filtering) and missing output escaping in bsp_topic_content_append_topic_fields() (which concatenates the stored meta value into an HTML <span> and echoes it via apply_filters/echo without esc_html()). This makes it possible for authenticated attackers, with Subscriber-level access and above (who have bbPress topic-creation privileges), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, including unauthenticated visitors.
AnalysisAI
Stored Cross-Site Scripting in the bbp Style Pack WordPress plugin (versions up to and including 6.4.5) allows authenticated attackers with Subscriber-level access and bbPress topic-creation privileges to permanently inject arbitrary JavaScript into forum topic pages via the Topic Form Additional Fields feature, with payload execution affecting all subsequent visitors including unauthenticated users. The flaw is a paired failure: unsanitized POST data written to post meta in bsp_topic_fields_form_save(), then rendered into raw HTML in bsp_topic_content_append_topic_fields() without output escaping. No public exploit has been identified at time of analysis, though Wordfence has confirmed the vulnerability with function-level detail and an upstream patch commit (changeset 3601461) exists.
Technical ContextAI
The bbp Style Pack plugin extends bbPress - a WordPress forum plugin - with additional UI styling and the Topic Form Additional Fields feature, which allows customization of topic submission forms. The vulnerability is a classic two-stage Stored XSS pattern (CWE-79) with failures on both the write and read paths. On the write path, bsp_topic_fields_form_save() accepts $_POST['bsp_topic_fields_label{n}'] inputs and persists them to WordPress post meta via update_post_meta() without any sanitization such as sanitize_text_field() or wp_kses(). On the read/render path, bsp_topic_content_append_topic_fields() retrieves those stored values and concatenates them directly into HTML <span> elements, echoing via apply_filters/echo without calling WordPress's standard output-escaping functions esc_html() or esc_attr(). Both vulnerable code paths are confirmed in the WordPress plugin SVN repository at bbp-style-pack/tags/6.4.5/includes/functions_topic_fields.php (lines 146 and 235 respectively). The absence of escaping at both storage and output stages means no single downstream fix is sufficient - both layers require correction.
RemediationAI
The primary fix is to update the bbp Style Pack plugin to the version released after upstream patch commit (changeset 3601461); administrators should check the WordPress plugin repository directly for the latest available version, as the exact patched release number is not confirmed from available data - only that 6.4.5 is the last vulnerable version. Wordfence Premium subscribers have immediate firewall rule coverage; free-tier users receive protection after a 30-day delay. If immediate patching is not possible, the most targeted compensating control is to disable the Topic Form Additional Fields feature within the bbp Style Pack plugin settings, which eliminates the vulnerable code path entirely without removing the plugin - though this sacrifices that feature's functionality. Secondary controls include restricting WordPress Subscriber self-registration (Settings > General > Membership) if public forum access is not required, or raising the minimum role required for bbPress topic creation to Editor or Administrator, both of which eliminate the low-privilege attacker entry point at the cost of reduced forum accessibility. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/f898ab34-2d63-458d-b19b-4e2b6f4a0f3b should be consulted for additional guidance.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today