Packagist (Composer) package
bbpress/bbpress
pkg:composer/bbpress/bbpress
Vulnerabilities (3)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2020-13693 | Cri | 9.8 | < 2.6.5 | 2.6.5 | May 29, 2020 | An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled. | |
| CVE-2020-13487 | Med | 4.8 | <= 2.6.4 | — | May 26, 2020 | The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=forum (aka the Forum listing page) for all users. An administrator can exploit this at the wp-admin/post.php?action=edit U | |
| CVE-2011-1150 | Med | 6.1 | <= 1.0.2 | — | Feb 5, 2020 | bbPress through 1.0.2 has XSS in /bb-login.php url via the re parameter. |
- affected < 2.6.5fixed 2.6.5
An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled.
- affected <= 2.6.4
The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=forum (aka the Forum listing page) for all users. An administrator can exploit this at the wp-admin/post.php?action=edit U
- affected <= 1.0.2
bbPress through 1.0.2 has XSS in /bb-login.php url via the re parameter.