CVE-2026-15010 is a stored cross-site scripting vulnerability in the bbp Style Pack WordPress plugin (up to version 6.4.5). The issue is due to the function bsp_topic_fields_form_save() writing user-supplied input ($_POST['bsp_topic_fields_label{n}']) directly to post meta without sanitization, and bsp_topic_content_append_topic_fields() outputting this data inside an HTML <span> without escaping. Authenticated attackers with Subscriber-level privileges or higher who can create bbPress topics can inject arbitrary scripts that execute in the context of any user visiting the injected page, including unauthenticated visitors. This vulnerability can lead to information disclosure and session hijacking risks.

An attacker with Subscriber-level access or higher can inject malicious JavaScript into bbPress topic pages via the Topic Form Additional Fields. This script executes in the browsers of any visitors to the affected pages, potentially leading to credential theft, session hijacking, or other malicious actions performed in the context of the victim's browser. The vulnerability does not affect availability but impacts confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict topic creation privileges to trusted users only and consider disabling the Topic Form Additional Fields feature if possible. Monitor for updates from the plugin vendor and apply patches promptly once released.