PT-2026-22479 · WordPress · Wpforo Forum

Scott Moore · Published 2026-02-28 · Updated 2026-03-04 · CVE-2026-28558

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions wpForo Forum version 2.4.14

Description The software contains a stored cross-site scripting issue that permits authenticated subscribers to upload specially crafted SVG files as profile avatars. This is achieved through the avatar upload functionality. An attacker can upload an SVG file containing CSS injection or JavaScript event handlers. These handlers execute in the browsers of users who view the attacker’s profile page.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-28558

Affected Products

Wpforo Forum

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-28558 · Security Note
• https://wordpress.org/plugins/wpforo/#developers · Patch
• https://osv.dev/vulnerability/CVE-2026-28558 · Vendor Advisory
• https://t.me/cveNotify/153650 · Telegram Post
• https://t.me/CVEtracker/46046 · Telegram Post
• https://wordpress.org/plugins/wpforo · Note
• https://vulncheck.com/advisories/wpforo-forum-stored-xss-via-svg-avatar-file-upload · Note
• https://t.me/cveNotify/154059 · Telegram Post