High · 7.1 CVE-2025-39432 EUVD-2025-11775GHSA-rfw7-86w9-7qh3

WordPress bbPress2 shortcode whitelist plugin <= 2.2.1 - CSRF to XSS vulnerability

Published Apr 17, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: antonchanning Product: bbPress2 shortcode whitelist

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in antonchanning bbPress2 shortcode whitelist bbpress2-shortcode-whitelist allows Stored XSS.This issue affects bbPress2 shortcode whitelist: from n/a through <= 2.2.1.

Affected products

Vendor	Product	Affected	Fixed
antonchanning	bbPress2 shortcode whitelist	≤ 2.2.1	—

References

https://patchstack.com/database/Wordpress/Plugin/bbpress2-shortcode-whitelist/vulnerability/wordpress-bbpress2-shortcode-whitelist-plugin-2-2-1-csrf-to-xss-vulnerability?_s_id=cve vdb-entry