PT-2026-22481 · WordPress · Wpforo Forum

Scott Moore · Published 2026-02-28 · Updated 2026-03-04 · CVE-2026-28560

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions wpForo Forum version 2.4.14

Description The software contains a stored cross-site scripting issue that allows for script injection. This is achieved by manipulating forum URL data, which is then output into an inline script block using the json encode function without the JSON HEX TAG flag. An attacker can set a forum slug containing a closing script tag or an unescaped single quote to break out of the JavaScript string context and execute arbitrary script in the browsers of visitors.

Recommendations Update wpForo Forum to a version with a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-28560

Affected Products

Wpforo Forum

References · 8

• https://wordpress.org/plugins/wpforo/#developers · Patch
• https://osv.dev/vulnerability/CVE-2026-28560 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28560 · Security Note
• https://twitter.com/cyberbivash/status/2027907865717948839 · Twitter Post
• https://t.me/CVEtracker/46048 · Telegram Post
• https://t.me/cveNotify/154061 · Telegram Post
• https://wordpress.org/plugins/wpforo · Note
• https://vulncheck.com/advisories/wpforo-forum-stored-xss-via-unsafe-json-encoding-in-inline-script · Note