Bbp Move Topics Vulnerabilities

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pascal Casier bbPress Move Topics bbp-move-topics allows Reflected XSS.This issue affects bbPress Move Topics: from n/a through <= 1.1.6.

Affected:

up to 1.1.6

Fix:

No patched version reported

Disclosed:

Oct 22, 2025

CVE-2025-49959 on NVD →

The bbPress Move Topics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can succ...

CVSS:

6.1

Affected:

up to 1.1.6

Fix:

No patched version reported

Disclosed:

Jul 16, 2025

CVE-2025-49959 on NVD →

[en] The bbp-move-topics plugin before 1.1.6 for WordPress has code injection.

Affected:

up to 1.1.6

Fixed in:

1.1.6

Disclosed:

Aug 27, 2019

CVE-2018-21005 on NVD →

[en] The bbp-move-topics plugin before 1.1.6 for WordPress has CSRF.

Affected:

up to 1.1.6

Fixed in:

1.1.6

Disclosed:

Aug 27, 2019

CVE-2018-21006 on NVD →

The bbPress Move Topics plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.1.4 via deserialization of untrusted input via the 'aforums_move_topics_page()' function where it passes the decoded 'allforums' value through the 'unserialize()' function. This allows authenticated at...

CVSS:

8.8

Affected:

up to 1.1.4

Fixed in:

1.1.6

Disclosed:

Mar 11, 2018

CVE-2018-21005 on NVD →

The bbp-move-topics plugin before 1.1.5 for WordPress has CSRF.

CVSS:

8.8

Affected:

up to 1.1.5

Fixed in:

1.1.5

Disclosed:

Mar 11, 2018

CVE-2018-21006 on NVD →