CVE-2026-101925

Name of the Vulnerable Software and Affected Versions bbp style pack versions prior to 6.4.9

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. This is achieved by manipulating the display name parameter via the '/wp-admin/profile.php' endpoint and the bbp reply content parameter via the bbPress reply form. To bypass WordPress's wpautop/wptexturize processors, which normally neutralize attribute-injection by converting double quotes into curly-quote entities, the attacker must wrap the crafted reply in a

 block. This allows the injection of arbitrary web scripts that execute when a user accesses the affected page.

Recommendations
Update bbp style pack to version 6.4.9 or later.