bbP Plugin: Any Javascript posted to the forum is executed.

[tooltrainer]

I can post this in any topic description or reply and it will be executed when the page is loaded:

<script type='text/javascript'>
location.href='​http://google.com';
</script>

Really scary, means users can hijack the site or do many other bad bad things.

[johnjamesjacoby]

Not a bug. You have the unfiltered_html capability because you are a site admin. In the future please refrain from posting any possible security vulnerabilities publicly, and instead reference the Security FAQ over at WordPress.org:

​http://codex.wordpress.org/Security_FAQ