https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 03:06:45 +0000 https://db.gcve.eu/vuln/cve-2026-101925 <p><strong>Affected:</strong> robin-w bbp style pack</p> <p>The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;display_name (via /wp-admin/profile.php) + bbp_reply_content (via bbPress reply form)&#39; parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the attacker to wrap their crafted reply in a &amp;lt;pre&amp;gt; block, which prevents WordPress&#39;s wpautop/wptexturize processors from converting straight double quotes in the stored display name into typographic curly-quote entities that would otherwise neutralize the attribute-injection.</p> <p><strong>Affected:</strong> robin-w bbp style pack</p> <p>The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;display_name (via /wp-admin/profile.php) + bbp_reply_content (via bbPress reply form)&#39; parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the attacker to wrap their crafted reply in a &amp;lt;pre&amp;gt; block, which prevents WordPress&#39;s wpautop/wptexturize processors from converting straight double quotes in the stored display name into typographic curly-quote entities that would otherwise neutralize the attribute-injection.</p> https://db.gcve.eu/vuln/cve-2026-101925