CVE-2025-53228 HIGH

CVE-2025-53228: WordPress bbpress Simple Advert Units Plugin <= 0.41 - Cross Site Scripting (XSS) Vulnerability

Vendor Jezza101
Product bbpress Simple Advert Units
Weakness CWE-79 · XSS
Published February 20, 2026
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jezza101 bbpress Simple Advert Units bbpress-simple-advert-units allows Reflected XSS.This issue affects bbpress Simple Advert Units: from n/a through <= 0.41.

Explanation of Vulnerability in Simple Terms

02Summary

bbPress Simple Advert Units versions 0.41 and earlier contain a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts into advert content that execute in the browsers of site visitors. The vulnerability requires user interaction—a victim must view a page containing the malicious advert. This can lead to session hijacking, credential theft, or defacement.

What an attacker can do

03Attacker Capabilities

Inject malicious scripts that run in visitors' browsers when they view adverts on the site.

Potential impact on your site

04Site Impact

Visitors' sessions and credentials can be compromised; site reputation and user trust may be damaged.

Conditions required to exploit

05Prerequisites

No authentication required. A victim must view a page containing the malicious advert.

Key dates

06Disclosure timeline

February 20, 2026 CVE published
April 28, 2026 Record updated