CVE-2026-15010 bbp style pack <= 6.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Topic Form Additional Fields
Authenticated attackers can inject arbitrary scripts via topic form fields, leading to code execution and potential account takeover for site visitors.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-15010?
CVE-2026-15010 is a medium-severity cross-site scripting vulnerability in robin-w bbp style pack, published on 11 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The bbp Style Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.4.5 via the Topic Form Additional Fields feature. This is due to insufficient input sanitization in bsp_topic_fields_form_save() (which writes $_POST['bsp_topic_fields_label{n}'] directly to post meta via update_post_meta() with no filtering) and missing output escaping in bsp_topic_content_append_topic_fields() (which concatenates the stored meta value into an HTML <span> and echoes it via apply_filters/echo without esc_html()). This makes it possible for authenticated attackers, with Subscriber-level access and above (who have bbPress topic-creation privileges), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, including unauthenticated visitors.
Weakness: CWE-79
Which versions are affected by CVE-2026-15010?
How do I fix CVE-2026-15010?
No fix has been published for CVE-2026-15010 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-15010 being exploited?
There is no known exploitation of CVE-2026-15010 in the wild and no public exploit code.
Sources
Also known as GHSA-qv97-pgw5-6f6x.