Bbpress is a lightweight forum and discussion plugin and platform that, despite a narrow product footprint, occupies a notable position in web-based community software deployments. Its vulnerability profile skews toward serious outcomes with an elevated share reaching critical severity, and public exploit code frequently accompanies disclosures in this space; the recurring weakness classes center on cross-site scripting, sensitive information exposure, and input-handling flaws that reflect the challenges of safely rendering user-generated content in forum environments. Live severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Bbpress over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-13693CRITICAL An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled. | May 29, 2020 | 9.8 | 62 | NO | YES |
CVE-2011-1150MEDIUM bbPress through 1.0.2 has XSS in /bb-login.php url via the re parameter. | Feb 5, 2020 | 6.1 | 22 | NO | NO |
CVE-2007-3243MEDIUM Cross-site scripting (XSS) vulnerability in bb-login.php in bbPress 0.8.1 allows remote attackers to inject arbitrary web script or HTML via the re parameter. NOTE: exploitation m | Jun 15, 2007 | 4.3 | 22 | NO | YES |
CVE-2007-3244HIGH SQL injection vulnerability in bb-includes/formatting-functions.php in bbPress before 0.8.1 might allow remote attackers to execute arbitrary SQL commands via unspecified vectors t | Jun 15, 2007 | 7.5 | 19 | NO | NO |
CVE-2020-13487MEDIUM The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=forum (aka the Forum l | May 26, 2020 | 4.8 | 16 | NO | NO |
CVE-2011-3710MEDIUM bbPress 1.0.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated | Sep 23, 2011 | 5.0 | 16 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Bbpress.
Media articles that mention a CVE ID that affects a product developed by Bbpress — matched by CVE ID, not by vendor name.