Vulnerabilities
Summary — last 7 days
New vulnerabilities5,066▲ 1,827 vs. last week
Critical / high2,830▲ 1,274 vs. last week
New active exploitation (KEV)9▲ 4 vs. last week
Unscored (no CVSS)162▼ 46 vs. last week
4 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | Medium (6.4) | 0.20% | — | BBP Style PackAI | 10/1/2026 | 10/1/2026 | The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name (via /wp-admin/profile.php) + bbp_reply_content (via bbPress reply form)' parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This makes it possible… | |
| Deferred | Medium (6.4) | 0.33% | — | BBP Style PackAI | 7/11/2026 | 7/13/2026 | The bbp Style Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.4.5 via the Topic Form Additional Fields feature. This is due to insufficient input sanitization in bsp_topic_fields_form_save() (which writes $_POST['bsp_topic_fields_label{n}'] directly to post… | |
| Modified | Medium (5.4) | 0.39% | — | Rewweb BBP Style Pack | 10/16/2023 | 6/17/2026 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Robin Wilson bbp style pack plugin <= 5.6.7 versions. | |
| Modified | Medium (6.1) | 0.39% | — | BBP Style Pack Project BBP Style Pack | 6/22/2023 | 6/17/2026 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Robin Wilson bbp style pack plugin <= 5.5.5 versions. |