PT-2026-22482 · WordPress · Wpforo Forum

Scott Moore · Publicado 2026-02-28 · Atualizado 2026-03-05 · CVE-2026-28561

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions wpForo Forum version 2.4.14

Description The software contains a stored cross-site scripting issue. This allows administrators to inject persistent JavaScript through forum description fields. The injected script executes when any user views the forum listing because the forum description is echoed without proper output escaping across multiple theme template files. On multisite installations or with a compromised admin account, an attacker can set a forum description containing HTML event handlers.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, sanitize all input to the forum description fields to prevent the injection of malicious scripts. Restrict administrator account privileges to minimize the impact of a potential compromise.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-28561

Produtos afetados

Wpforo Forum

Referências · 9

• https://twitter.com/cyberbivash/status/2027907863885087190 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-28561 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-28561 · Aviso do Fabricante
• https://wordpress.org/plugins/wpforo/#developers · Correção
• https://twitter.com/VulmonFeeds/status/2027876814413082624 · Publicação no Twitter
• https://vulncheck.com/advisories/wpforo-forum-stored-xss-via-unescaped-forum-description-in-templates · Nota
• https://t.me/cveNotify/154343 · Publicação no Telegram
• https://t.me/CVEtracker/46049 · Publicação no Telegram
• https://wordpress.org/plugins/wpforo · Nota