EUVD-2026-51698
GHSA-fpc7-m22h-66jv
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
PR:L because subscriber account is required; UI:R because victim must browse the profile; S:C captures JavaScript executing in victim's separate browser security context.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor who views the profile, including a logged-in administrator.
AnalysisAI
Stored cross-site scripting in wpForo Forum WordPress plugin before 3.1.2 allows a subscriber-level authenticated user to inject persistent JavaScript into a profile field that executes in any visitor's browser - including logged-in administrators - upon viewing the attacker's public participant profile page. A publicly available proof-of-concept exploit exists, and the CVSS scope change (S:C) reflects that the injected script runs in victim browser contexts entirely outside the plugin's security boundary, enabling credential theft or admin-level site takeover. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker hold at minimum a subscriber-level (lowest registered) WordPress account on the target site, meaning open user registration is a significant risk amplifier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The raw CVSS score of 5.4 (Medium) understates the realistic impact for sites where administrators actively browse user profiles. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a free subscriber account on a target WordPress site running wpForo Forum, then edits their profile to insert a JavaScript payload (e.g., a cookie-stealing script) into a vulnerable profile field. When a site administrator visits the attacker's public forum profile - a routine action when reviewing flagged users - the script executes silently in the admin's browser, exfiltrating the session cookie to an attacker-controlled server and enabling full administrative takeover. … |
| Remediation | The primary fix is to update wpForo Forum to version 3.1.2 or later via the WordPress plugin dashboard or by downloading directly from the WordPress plugin repository; this is confirmed as available per the WPScan advisory at https://wpscan.com/vulnerability/0dde2d89-267f-4aca-b2f0-d086b15adff0/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wpforo Forum
View allThe wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deseria
The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'slug' attribute of the 'wpforo' shortcode
The wpForo Forum WordPress plugin before 2.1.9 does not escape some request parameters while in debug mode, leading to a
The wpForo Forum WordPress plugin before 1.9.7 did not validate the redirect_to parameter in the login form of the forum
wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unaut
Unauthenticated PHP Object Injection in the wpForo Forum WordPress plugin versions 3.1.0 and earlier allows remote attac
Authentication bypass in the wpForo Forum WordPress plugin versions 3.1.0 and earlier allows remote unauthenticated atta
Insecure Direct Object Reference (IDOR) in the wpForo Forum WordPress plugin before 3.1.2 allows any subscriber-level au
Unauthenticated SQL injection in the wpForo Forum WordPress plugin (versions 3.0.4 and earlier) allows remote attackers
Arbitrary file deletion in wpForo Forum WordPress plugin versions ≤2.4.16 allows authenticated attackers with subscriber
Auth. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch
Cross-Site Request Forgery (CSRF) vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress. Rated high severity (CVSS
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today