Discussion Board Wordpress Forum Plugin
Monthly
Stored cross-site scripting in the Discussion Board - WordPress Forum plugin (versions up to and including 2.6.0) lets any authenticated user with subscriber-level access or higher place a script payload in the WordPress profile Website (user_url) field. The plugin's ctdb_filter_comment_author_name() callback, hooked to get_comment_author_link, interpolates that raw URL into a single-quoted href attribute without esc_url() or esc_attr(), so the payload executes in the browser of anyone who opens a forum topic containing the attacker's reply. CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N); no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Stored cross-site scripting in the Discussion Board - WordPress Forum plugin (versions up to and including 2.6.0) lets any authenticated user with subscriber-level access or higher place a script payload in the WordPress profile Website (user_url) field. The plugin's ctdb_filter_comment_author_name() callback, hooked to get_comment_author_link, interpolates that raw URL into a single-quoted href attribute without esc_url() or esc_attr(), so the payload executes in the browser of anyone who opens a forum topic containing the attacker's reply. CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N); no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.