plugin
23 known security issues reported for the Bbpress WordPress plugin. Most recent disclosed Mar 4, 2025.
Running Bbpress on your site? Check whether your installed version is affected.
Scan your site freeThe bbPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.11. This is due to missing or incorrect nonce validation on the bbp_user_add_role_on_register() function. This makes it possible for unauthenticated attackers to elevate their privileges to that of a b...
The bbPress plugin for WordPress is vulnerable to unauthenticated privilege escalation in versions up to, and including, 2.6.4. This is due to a logic bug within the signup process. This makes it possible for unauthenticated attackers to grant themselves a role that will provide authorization to delete forum activities...
The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=forum (aka the Forum listing page) for all users. An administrator can exploit this at the wp-admin/post.php?action=edit URI.
[en] An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled.
Authenticated Privilege Escalation vulnerability discovered by hoangkien1020 in WordPress bbPress plugin (versions <= 2.6.4).
[en] The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=forum (aka the Forum listing page) for all users. An administrator can exploit this at the wp-admin/post.php?action=edit URI.
The bbPress plugin for WordPress is vulnerable to blind SQL Injection via the ‘anonymous_data’ parameter in versions up to, and including, 2.5.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers...
The bbPress plugin for WordPress is vulnerable to blind SQL Injection via the ‘anonymous_data’ parameter in versions up to, and including, 2.5.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers...
This plugin is prone to display name and avatar potential cross site scripting vulnerability. Update plugin.
The bbPress plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 2.5.9 due to insufficient input sanitization and output escaping on user profile fields. This makes it possible for unauthorized attackers to inject arbitrary web scripts that execute in a victim's browser.
The bbPress plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 2.5.9 due to insufficient input sanitization and output escaping on user profile fields. This makes it possible for unauthorized attackers to inject arbitrary web scripts that execute in a victim's browser.
The bbPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bbp_mention_filter function in versions up to, and including, 2.5.8 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a...
Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Update plugin.
The bbPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bbp_mention_filter function in versions up to, and including, 2.5.8 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a...
This bbPress plugin is prone to multiple vulnerabilities such as SQL injection, full path disclosure and directory listing vulnerabilities. Update the plugin.
The bbPress WordPress plugin was affected by a Display Name & Avatar Potential Cross-Site Scripting (XSS) security vulnerability.
The bbPress WordPress plugin was affected by a Stored Cross-Site Scripting (XSS) security vulnerability.
The bbPress WordPress plugin was affected by a forum.php page Parameter SQL Injection security vulnerability.
The bbPress WordPress plugin was affected by a Multiple Script Malformed Input Path Disclosure security vulnerability.
Requires anonymous posting option to be enabled and WordPress version < 4.8.3.
Due to the way post slugs are handled, low privileged users could perform Cross-Site Scripting attacks against admins
hoangkien1020 discovered an authenticated privilege escalation issue via the super moderator feature.
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free