PT-2026-22481 · WordPress · Wpforo Forum

Scott Moore · Publicado 2026-02-28 · Atualizado 2026-03-04 · CVE-2026-28560

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions wpForo Forum version 2.4.14

Description The software contains a stored cross-site scripting issue that allows for script injection. This is achieved by manipulating forum URL data, which is then output into an inline script block using the json encode function without the JSON HEX TAG flag. An attacker can set a forum slug containing a closing script tag or an unescaped single quote to break out of the JavaScript string context and execute arbitrary script in the browsers of visitors.

Recommendations Update wpForo Forum to a version with a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-28560

Produtos afetados

Wpforo Forum

Referências · 8

• https://twitter.com/cyberbivash/status/2027907865717948839 · Publicação no Twitter
• https://wordpress.org/plugins/wpforo/#developers · Correção
• https://t.me/CVEtracker/46048 · Publicação no Telegram
• https://t.me/cveNotify/154061 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-28560 · Aviso do Fabricante
• https://wordpress.org/plugins/wpforo · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-28560 · Nota de Segurança
• https://vulncheck.com/advisories/wpforo-forum-stored-xss-via-unsafe-json-encoding-in-inline-script · Nota