CVE-2026-101925 is a stored cross-site scripting vulnerability in the robin-w bbp style pack WordPress plugin. It affects versions up to and including 6.4.8. The flaw is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of the 'display_name' parameter (via /wp-admin/profile.php) combined with 'bbp_reply_content' (via the bbPress reply form). Authenticated users with subscriber or higher privileges can inject malicious scripts that execute in the context of other users viewing the affected pages. The attack requires wrapping the payload in a <pre> block to avoid WordPress's wpautop/wptexturize filters that would otherwise neutralize the injection by converting quotes to curly quotes.

Successful exploitation allows an authenticated attacker with subscriber-level access or higher to inject and execute arbitrary JavaScript in the browsers of users who view the injected content. This can lead to information disclosure, session hijacking, or other client-side attacks. The vulnerability does not affect unauthenticated users directly and does not impact availability.

No official patch or fix is currently referenced. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level user permissions where possible and monitor for suspicious activity. Avoid allowing untrusted users to submit content that is rendered with insufficient sanitization. Consider applying custom input validation or output escaping as a temporary mitigation.