Inline Image Upload for BBPress
Inline Image Upload for BBPress has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2025; all 2 are fixed as of September 2026. Their average CVSS score is 6.6, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Unrestricted Upload Of File With Dangerous Type.
Every one of the 2 issues recorded for Inline Image Upload for BBPress has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. Inline Image Upload for BBPress is installed on roughly 3,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2025-2006Inline Image Upload for BBPress <= 1.1.19 - Authenticated (Subscriber+) Arbitrary File Upload
Read the full analysisVulnerability Records
Inline Image Upload for BBPress
Author
BerryPress
This plugin enables the TinyMCE WYSIWYG editor for BBPress forum topics and replies and adds a button to the editor’s “Insert/edit image” dialog that allows forum users to upload images from their computer and insert them inline into their posts. A pro version with the following additional features is also available: Change the directory where uploaded images are stored. Limit which user roles are permitted to upload images. Limit the number of uploaded images allowed per post. Automatically downsize images to fit specified maximum dimensions. Convert all uploaded images to the same image format, if desired. Set PNG and JPEG compression levels so images take up less disk space. Allow users to view enlarged images in a lightbox by clicking on them within the post. View total image count and file size statistics. Use Amazon S3™ to store and serve uploaded images in submitted forum posts (optional; requires add-on plugin purchase). Amazon Web Services, the “Powered by Amazon Web Services” logo, AWS, Amazon Simple Storage Service, and Amazon S3 are trademarks of Amazon.com, Inc. or its affiliates in the United States and/or other countries. Potent Plugins is not affiliated with Amazon.com, Inc. or Amazon Web Services. If you like this plugin, please consider leaving a comment or review. You may also like these plugins BerryPress has built a bunch of plugins. Check out other favorites here on the repository and don’t forget to leave a 5-star review to help others in the community decide. Product Sales Report for WooCommerce – setup a custom sales report for the products in your WooCommerce store with toggle sorting options. Including or excluding items based on date range, sale status, product category and id, define display order, choose what fields to include, and generate your report with a click. Export Order Items for WooCommerce – export the order details for each sale in your WooCommerce store. Simplify order fulfillment, generate accounting reports in a few clicks, and download into CSV format for readability and universal compatibility with Export Order Items. To view BerryPress’s premium WordPress plugins, visit our WordPress products catalog page.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C