What is the CVSS score of EUVD-2026-44899?

EUVD-2026-44899 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

wpForo Forum EUVD-2026-44899

| CVE-2026-15021 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-16 Wordfence

GHSA-76cp-m73j-f6wq

WordPress XSS Wpforo Forum Wordpress Plugin Tomdever

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Stored XSS requires victim to load the injected page (UI:R); subscriber auth required (PR:L); scope change confirmed as payload executes in other users' sessions (S:C).

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 09:08 vuln.today

CVE Published

Jul 16, 2026 - 08:26 cve.org

MEDIUM 6.4

DescriptionCVE.org

The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'location' Profile Field in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The sanitize_text_field() function applied at input does not encode double quotes, allowing attribute breakout via a payload that escapes the href attribute context and injects event handler attributes.

AnalysisAI

Stored Cross-Site Scripting in the wpForo Forum WordPress plugin (all versions through 3.1.1) allows authenticated attackers with subscriber-level access to permanently inject malicious JavaScript via the 'location' profile field. The root failure is WordPress's native sanitize_text_field() function, which strips tags but leaves double quotes unencoded, enabling attribute breakout from an href context into injected event-handler attributes. With a CVSS scope change (S:C), successful exploitation can impact sessions of any user - including administrators - who views a poisoned profile page, enabling session hijacking or privilege escalation. No public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

wpForo Forum (CPE: cpe:2.3:a:tomdever:wpforo_forum) is a WordPress plugin providing community forum functionality. The vulnerability resides in the 'location' profile field, processed in Forms.php (lines 1035, 1074) and Members.php (line 1031) as confirmed by the WordPress plugin trac source references for both the 3.0.5 and 3.1.1 tags. CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root class: user-supplied input is stored and later rendered in an HTML attribute context without proper output encoding. The specific failure is reliance on WordPress's sanitize_text_field() at input time, which strips HTML tags and encodes some characters but does NOT encode double quotes. An attacker can supply a payload such as [space]" onclick="payload that terminates the href attribute value and injects an event-handler attribute, which the browser executes when a user interacts with or simply loads the rendered element. Because the injected script runs in the victim's browser session, the effective scope extends beyond the submitting user to any viewer of that profile page.

RemediationAI

A code-level fix is referenced by the WordPress plugin trac changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3603849%40wpforo&new=3603849%40wpforo; however, the exact patched release version is not confirmed from the available intelligence data - site administrators should update wpForo Forum to the latest version available in the WordPress Plugin Directory and verify the installed version exceeds 3.1.1. The remediation must switch from sanitize_text_field() to proper HTML attribute encoding (e.g., esc_attr() in WordPress) on output of the location field in Forms.php (lines ~1035, ~1074) and Members.php (line ~1031). As a compensating control while patching is pending, administrators can restrict new user registrations to prevent unauthenticated individuals from obtaining subscriber accounts, or limit access to profile editing for subscriber-level users via role management plugins. The trade-off of restricting registration is that it disables forum onboarding; limiting profile editing may break intended forum functionality. Full details are at https://www.wordfence.com/threat-intel/vulnerabilities/id/2cd364c5-c053-4c50-8232-bb47ab8e834b.