CVE-2026-15010: bbPress Style Pack Plugin XSS Vulnerability

CVE-2026-15010 Overview

CVE-2026-15010 is a Stored Cross-Site Scripting (XSS) vulnerability in the bbp Style Pack plugin for WordPress, affecting all versions up to and including 6.4.5. The flaw resides in the Topic Form Additional Fields feature, where bsp_topic_fields_form_save() writes $_POST['bsp_topic_fields_label{n}'] directly to post meta without sanitization, and bsp_topic_content_append_topic_fields() renders the stored value without output escaping. Authenticated users with Subscriber-level access and above who possess bbPress topic-creation privileges can inject arbitrary JavaScript. The payload executes in the browser of any visitor who views the affected page, including unauthenticated users. The vulnerability is tracked under [CWE-79].

Critical Impact
Authenticated Subscriber-level attackers can inject persistent JavaScript that executes in every visitor's browser, enabling session theft, credential harvesting, and administrative account takeover through cross-site scripting.

Affected Products

bbp Style Pack plugin for WordPress — versions up to and including 6.4.5
WordPress sites running bbPress with topic-creation privileges granted to Subscriber-level users
Any front-end page rendering topic content containing the injected additional field labels

Discovery Timeline

2026-07-11 - CVE-2026-15010 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-15010

Vulnerability Analysis

The vulnerability originates in the bbp Style Pack plugin's handling of custom topic form fields. When a bbPress topic is submitted, the bsp_topic_fields_form_save() function processes user-supplied bsp_topic_fields_label{n} parameters from the $_POST array. These parameters are written directly to WordPress post meta via update_post_meta() with no input filtering, sanitization, or validation applied.

When the topic is later rendered, bsp_topic_content_append_topic_fields() retrieves the stored meta value and concatenates it into an HTML <span> element. The plugin then emits the resulting markup through apply_filters() and echo without wrapping the value in esc_html() or an equivalent escaping function. Any script content injected at save time is served as executable HTML.

Because the payload is stored server-side, every visitor who loads the topic page triggers execution. Unauthenticated users are exposed, which amplifies the reach of any single injected script.

Root Cause

The root cause is dual: missing input sanitization at the write path and missing output escaping at the read path. A defense-in-depth implementation would apply sanitize_text_field() (or equivalent) before update_post_meta() and esc_html() before echoing the stored value. The plugin does neither, leaving the label field as a raw sink for arbitrary HTML and JavaScript.

Attack Vector

An attacker registers or uses an existing account with Subscriber-level or higher privileges on a target WordPress site running the vulnerable plugin. The attacker submits a bbPress topic containing a crafted bsp_topic_fields_label{n} POST parameter with a JavaScript payload embedded in HTML tags such as <script> or event-handler attributes. Once saved, the payload executes whenever any user, authenticated or not, views the affected topic page. Common post-exploitation objectives include stealing administrator session cookies, performing forced actions via CSRF, and pivoting to full site takeover. Technical references are available in the Wordfence Vulnerability Report and the WordPress Code Changeset.

Detection Methods for CVE-2026-15010

Indicators of Compromise

Post meta entries under keys matching bsp_topic_fields_label* containing <script>, onerror=, onload=, or javascript: substrings
Unexpected outbound requests from visitor browsers to attacker-controlled domains following topic page loads
New or modified WordPress administrator accounts created shortly after Subscriber accounts submitted bbPress topics
Session cookies appearing in web server referrer logs of external domains

Detection Strategies

Query the wp_postmeta table for meta_key LIKE 'bsp_topic_fields_label%' and inspect meta_value for HTML tags or JavaScript keywords
Deploy a Web Application Firewall (WAF) rule that inspects POST parameters matching bsp_topic_fields_label for script content
Enable Content Security Policy (CSP) reporting to surface inline script execution originating from bbPress topic pages

Monitoring Recommendations

Log and review all bbPress topic submissions from non-privileged user roles, correlating account age with content submission patterns
Monitor WordPress role and capability changes, particularly promotions from Subscriber to Administrator
Alert on file integrity changes to bbp-style-pack plugin directories outside of scheduled maintenance windows

How to Mitigate CVE-2026-15010

Immediate Actions Required

Update the bbp Style Pack plugin to a version later than 6.4.5 that includes the fix committed in the WordPress Code Changeset
Audit existing bbPress topics and wp_postmeta entries for injected payloads and remove malicious content
Rotate administrator session cookies and reset credentials for any account that accessed affected topic pages

Patch Information

The plugin maintainers addressed the issue by adding sanitization on save and output escaping on render. Review the vulnerable code paths in the functions_topic_fields.php implementation at line 146 and line 235, then apply the vendor-supplied update. Confirm the WordPress plugins page reports the updated version after deployment.

Workarounds

Deactivate the bbp Style Pack plugin until the patched version is installed if immediate upgrade is not possible
Restrict bbPress topic creation to trusted user roles by removing publish_topics capability from Subscribers using a role management plugin
Deploy a WAF rule blocking POST requests containing HTML tags in any bsp_topic_fields_label* parameter
Enforce a strict Content Security Policy that disallows inline <script> execution on bbPress forum pages

bash

# Configuration example: remove topic creation capability from Subscriber role via WP-CLI
wp cap remove subscriber publish_topics
wp cap remove subscriber edit_topics

# Verify plugin version after patching
wp plugin get bbp-style-pack --field=version