Input validation vulnerability in bbPress 2.5.9

The bbPress plugin for WordPress is vulnerable to a type of attack called Stored Cross-Site Scripting. This vulnerability exists in versions up to and including 2.5.8. It is caused by the bbp_mention_filter function not adequately preventing malicious code from being added to webpages. If an attacker is able to inject malicious code into a webpage, that code will be executed each time a user visits the page.