EUVD-2026-51698
GHSA-fpc7-m22h-66jv
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
PR:L because subscriber account is required; UI:R because victim must browse the profile; S:C captures JavaScript executing in victim's separate browser security context.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor who views the profile, including a logged-in administrator.
AnalysisAI
Stored cross-site scripting in wpForo Forum WordPress plugin before 3.1.2 allows a subscriber-level authenticated user to inject persistent JavaScript into a profile field that executes in any visitor's browser - including logged-in administrators - upon viewing the attacker's public participant profile page. A publicly available proof-of-concept exploit exists, and the CVSS scope change (S:C) reflects that the injected script runs in victim browser contexts entirely outside the plugin's security boundary, enabling credential theft or admin-level site takeover. EPSS is low (0.15%, 5th percentile), suggesting mass exploitation has not yet materialized despite the public POC.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause: the plugin renders user-controlled profile data directly inside an HTML attribute without sanitization or context-aware escaping, allowing an attacker to break out of the attribute context and inject executable script. Because the payload is stored server-side and served to any visitor of the profile page, this is a stored (persistent) XSS variant - more dangerous than reflected XSS as it does not require tricking victims into clicking a crafted URL. The affected product is identified in CPE as cpe:2.3:a:unknown:wpforo_forum:*:*:*:*:*:*:*:* across all versions prior to 3.1.2. The scope change (S:C in CVSS 3.1) captures the reality that injected JavaScript executes within the victim's browser security context, which is logically separate from the WordPress application itself.
RemediationAI
The primary fix is to update wpForo Forum to version 3.1.2 or later via the WordPress plugin dashboard or by downloading directly from the WordPress plugin repository; this is confirmed as available per the WPScan advisory at https://wpscan.com/vulnerability/0dde2d89-267f-4aca-b2f0-d086b15adff0/. If immediate patching is not possible, a compensating control is to restrict new user registration to prevent untrusted users from creating subscriber accounts - this directly eliminates the attacker's entry point but limits forum functionality. Sites using a Web Application Firewall (WAF) such as Wordfence or Cloudflare can add rules to detect and block script injection in profile field submissions as a temporary measure, though WAF bypass remains a risk. Reviewing existing user profile fields for stored payloads post-patching is also advisable if the site had open registration prior to remediation.
More in Wpforo Forum
View allThe wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deseria
PHP object injection in the wpForo Forum WordPress plugin before 3.1.6 lets an authenticated attacker with Subscriber-le
The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'slug' attribute of the 'wpforo' shortcode
The wpForo Forum WordPress plugin before 2.1.9 does not escape some request parameters while in debug mode, leading to a
The wpForo Forum WordPress plugin before 1.9.7 did not validate the redirect_to parameter in the login form of the forum
wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unaut
Unauthenticated PHP Object Injection in the wpForo Forum WordPress plugin versions 3.1.0 and earlier allows remote attac
Authentication bypass in the wpForo Forum WordPress plugin versions 3.1.0 and earlier allows remote unauthenticated atta
Insecure Direct Object Reference (IDOR) in the wpForo Forum WordPress plugin before 3.1.2 allows any subscriber-level au
Rate-limit bypass in the wpForo Forum WordPress plugin (3.0.0 up to but not including 3.1.6) allows unauthenticated remo
Unauthenticated SQL injection in the wpForo Forum WordPress plugin (versions 3.0.4 and earlier) allows remote attackers
Arbitrary file deletion in wpForo Forum WordPress plugin versions ≤2.4.16 allows authenticated attackers with subscriber
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today