Junglewise Threat Intelligence

CVE-2026-15010: robin-w bbp Style Pack Stored XSS in Topic Form Additional Fields

CVE-2026-15010 · Severity: medium · CVSS 6.4 · Published 2026-07-11

Executive brief

The bbp Style Pack plugin for WordPress, which provides customization options for bbPress forums, contains a security flaw in its Topic Form Additional Fields feature. This vulnerability allows logged-in users with basic forum privileges to inject malicious scripts into forum topics. When other users or administrators view these topics, the scripts will execute in their browsers, potentially leading to unauthorized actions or data theft.

Technical details

The vulnerability is a Stored Cross-Site Scripting (XSS) flaw resulting from insufficient input sanitization and output escaping. Specifically, the function `bsp_topic_fields_form_save()` writes the `$_POST['bsp_topic_fields_label{n}']` parameter directly to post meta using `update_post_meta()` without filtering. Subsequently, `bsp_topic_content_append_topic_fields()` echoes this stored meta value into an HTML span tag without using `esc_html()`. Authenticated attackers with Subscriber-level access or higher (who possess bbPress topic-creation privileges) can exploit this to inject arbitrary JavaScript. The scripts execute whenever a user, including unauthenticated visitors or administrators, views the affected topic page.

Affected products

  • robin-w bbp Style Pack up to, and including, 6.4.5

Timeline

  • 2026-07-11: advisory: NVD published the CVE record based on Wordfence data.

References