[artmuns]

Anyone know about this?

During regular research audits of our Sucuri Firewall, we discovered a Stored XSS vulnerability affecting the bbPress plugin for WordPress, currently installed on 300,000 live websites, one of them being the popular wordpress.org support forum.

Exploitation Level: Easy/Remote
DREAD Score: 6/10
Vulnerability: Stored XSS
Patched Version: bbPress 2.5.9
As a Cross-Site Scripting (XSS) vulnerability, it could allow this user to hijack other user accounts, perform actions on their behalf (like administrators, moderators, etc.) to escalate its user’s privileges.

[Robin W]

which is why 2.5.9 has been released

https://bbpress.org/forums/topic/bbpress-2-5-9/

[artmuns]

Thanks, wasn’t sure if that Sucuri notification was for 2.5.9 or a previous version.

[Stephen Edgar]

Unfortunately the original Sucuri article incorrectly stated what versions of bbPress were affected, the article has seen been updated to document what versions of bbPress were affected. bbPress 2.5.9 patched the security issue documented by Sucuri.

[Robin W]

Thanks for the clarification Stephen !