PT-2026-22482 · WordPress · Wpforo Forum

Scott Moore · Published 2026-02-28 · Updated 2026-03-05 · CVE-2026-28561

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions wpForo Forum version 2.4.14

Description The software contains a stored cross-site scripting issue. This allows administrators to inject persistent JavaScript through forum description fields. The injected script executes when any user views the forum listing because the forum description is echoed without proper output escaping across multiple theme template files. On multisite installations or with a compromised admin account, an attacker can set a forum description containing HTML event handlers.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, sanitize all input to the forum description fields to prevent the injection of malicious scripts. Restrict administrator account privileges to minimize the impact of a potential compromise.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-28561

Affected Products

Wpforo Forum

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-28561 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28561 · Vendor Advisory
• https://wordpress.org/plugins/wpforo/#developers · Patch
• https://twitter.com/cyberbivash/status/2027907863885087190 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2027876814413082624 · Twitter Post
• https://vulncheck.com/advisories/wpforo-forum-stored-xss-via-unescaped-forum-description-in-templates · Note
• https://t.me/cveNotify/154343 · Telegram Post
• https://t.me/CVEtracker/46049 · Telegram Post
• https://wordpress.org/plugins/wpforo · Note