WordPress · Forumpress Wp Forum Server · CVE-2012-6622
**Name of the Vulnerable Software and Affected Versions**
ForumPress WP Forum Server plugin versions prior to 1.7.4
**Description**
The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the `groupid` parameter in an "editgroup" action or the `usergroup id` parameter in an "edit usergroup" action.
**Recommendations**
For versions prior to 1.7.4, update to version 1.7.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the `fs-admin/fs-admin.php` file to minimize the risk of exploitation. Avoid using the `groupid` and `usergroup id` parameters in the affected actions until the issue is resolved.