WP w3all phpBB EUVD-2026-101012

Exploitation requires an authenticated account with at least low privileges (PR:L) capable of submitting input that the WP w3all phpBB integration plugin stores, plus a second victim user who must view the affected page (UI:R) for the injected script to execute. Affected versions are from n/a through 3.1.0. Limiting factors: attacker cannot act fully unauthenticated, the payload only triggers when a victim loads the rendered content, and exploitation presupposes the WordPress-to-phpBB integration plugin is installed and active - a niche deployment prerequisite that narrows the realistic target population.

This is a moderate-risk Stored XSS (CWE-79) in the WP w3all phpBB integration plugin, reported by Patchstack with a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The vector indicates network-reachable, low-complexity exploitation but requires some authentication (PR:L) and victim user interaction (UI:R), with a scope change (S:C) reflecting that injected script executes in another security context (the victim's browser/session). No EPSS score was provided in the input, and there is no CISA KEV listing and no public POC referenced, so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent - this is a typical authenticated stored XSS, not a wormable unauthenticated RCE - so it should be treated as a routine patch-priority item rather than an emergency. The mitigating factors (required privileges and user interaction) materially lower real-world urgency, while the stored/persistent nature and scope change raise it above a trivial reflected XSS. No key signals conflict, but the absence of EPSS/KEV/POC data means widespread exploitation cannot be assessed and should not be assumed.

A low-privileged authenticated user (e.g., a forum/subscriber-level account on a site bridging WordPress and phpBB) submits input through a plugin field that is stored without proper neutralization. When an administrator or another user later views the page rendering that stored data, the injected JavaScript executes in their browser session, potentially enabling session/cookie theft or actions in the victim's context. No public exploit code was identified at the time of analysis.