bbPress stored Cross-Site Scripting (XSS) vulnerability in the Forum creation section

MEDIUM 4.8CVE-2020-13487 · GHSA-p9xp-xghp-gqvp · Published 26/05/2020 · updated 17/06/2026

Package	Affected versions	Patched versions
bbpress/bbpress Packagist	`≤ 2.6.4`	No fix yet
bbpress bbpress	`≤ 2.6.4`	No fix yet

Description

The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=forum (aka the Forum listing page) for all users. An administrator can exploit this at the wp-admin/post.php?action=edit URI.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2020-13487 · ADVISORY
bbpress.org · WEB
codex.bbpress.org/releases · WEB
bbpress/bbPress · PACKAGE
wordpress.org/plugins/bbpress · WEB
youtube.com/watch · WEB
bbpress.org · Vendor Advisory
codex.bbpress.org/releases · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free