PT-2026-22479 · WordPress · Wpforo Forum

Scott Moore · Publicado 2026-02-28 · Atualizado 2026-03-04 · CVE-2026-28558

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions wpForo Forum version 2.4.14

Description The software contains a stored cross-site scripting issue that permits authenticated subscribers to upload specially crafted SVG files as profile avatars. This is achieved through the avatar upload functionality. An attacker can upload an SVG file containing CSS injection or JavaScript event handlers. These handlers execute in the browsers of users who view the attacker’s profile page.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-28558

Produtos afetados

Wpforo Forum

Referências · 8

• https://t.me/cveNotify/153650 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-28558 · Nota de Segurança
• https://t.me/CVEtracker/46046 · Publicação no Telegram
• https://wordpress.org/plugins/wpforo/#developers · Correção
• https://wordpress.org/plugins/wpforo · Nota
• https://osv.dev/vulnerability/CVE-2026-28558 · Aviso do Fabricante
• https://vulncheck.com/advisories/wpforo-forum-stored-xss-via-svg-avatar-file-upload · Nota
• https://t.me/cveNotify/154059 · Publicação no Telegram