Reflected Cross-Site Scripting Vulnerability in Turnkey bbPress by WeaverTheme for WordPress
CVE-2024-12221

6.1MEDIUM

Key Information:

Vendor
Wordpress
Status
Turnkey Bbpress By Weavertheme
Vendor
CVE Published:
4 January 2025

Summary

The Turnkey bbPress plugin developed by WeaverTheme for WordPress has a vulnerability that allows for reflected cross-site scripting via the ‘_wpnonce’ parameter. This vulnerability exists in all versions up to and including 1.6.3, where inadequate input sanitization and output escaping procedures create an opportunity for unauthenticated attackers. If attackers can deceive users into clicking malicious links, they can execute arbitrary web scripts on the affected pages, potentially compromising user data and site integrity.

Affected Version(s)

Turnkey bbPress by WeaverTheme * <= 1.6.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/weaver-for-bbpress/
https://plugins.trac.wordpress.org/changeset/3209473/

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dale Mavers
.