CVE-2026-101925Published
bbp style pack <= 6.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Author Display Name
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-101925 · Microsoft / collected KEV context
cve-program · CVE-2026-101925
- https://www.wordfence.com/threat-intel/vulnerabilities/id/31c9b86b-c971-4a0b-95ef-10bc7781e93f?source=cve
- https://plugins.trac.wordpress.org/browser/bbp-style-pack/tags/6.4.8/includes/functions_quote.php#L249
- https://plugins.trac.wordpress.org/browser/bbp-style-pack/tags/6.4.8/includes/functions_quote.php#L223
- https://plugins.trac.wordpress.org/browser/bbp-style-pack/tags/6.4.8/includes/functions_quote.php#L244
- https://plugins.trac.wordpress.org/browser/bbp-style-pack/tags/6.4.8/includes/functions_quote.php#L83
- https://plugins.trac.wordpress.org/browser/bbp-style-pack/tags/6.4.8/includes/functions_quote.php#L275
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3719484%40bbp-style-pack&new=3719484%40bbp-style-pack
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.