Priority LOW 28
bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewide ignores ancestor forum visibility.
Vulnerabilities
7 records
TI-2020-10740 CVE-2020-13693 · GHSA-mwxh-6j9v-45ph
An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5…
Priority HIGH 71
An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled.
TI-2020-10577 CVE-2020-13487 · GHSA-p9xp-xghp-gqvp
The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation…
Priority LOW 25
The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=forum (aka the Forum listing page) for all users.
TI-2011-01003 CVE-2011-1150 · GHSA-483f-wxw9-3rpq
bbPress through 1.0.2 has XSS in /bb-login.php url via the re parameter.
Priority LOW 29
bbPress through 1.0.2 has XSS in /bb-login.php url via the re parameter.
TI-2011-03267 CVE-2011-3710 · GHSA-w3qr-fpxg-7xrw
bbPress 1.0.2 allows remote attackers to obtain sensitive information via a direct…
Priority LOW 26
bbPress 1.0.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by bb-templates/kakumei/view.php and cer…
TI-2007-03140 CVE-2007-3244 · GHSA-hr4f-v74c-rx23
SQL injection vulnerability in bb-includes/formatting-functions.php in bbPress before…
Priority LOW 36
SQL injection vulnerability in bb-includes/formatting-functions.php in bbPress before 0.8.1 might allow remote attackers to execute arbitrary SQL commands via unspecified vectors to forums/bb-edit.php, as demonstrated by…
TI-2007-03139 CVE-2007-3243 · GHSA-4xr7-vpx3-gqvp
Cross-site scripting (XSS) vulnerability in bb-login.php in bbPress 0.8.1 allows remote…
Priority LOW 24
Cross-site scripting (XSS) vulnerability in bb-login.php in bbPress 0.8.1 allows remote attackers to inject arbitrary web script or HTML via the re parameter.