CVE-2022-38055 MEDIUM

CVE-2022-38055: WordPress wpForo Forum plugin <= 2.0.9 - Auth. HTML Injection vulnerability

Vendor Gvectors Team

Product wpForo Forum

Weakness CWE-80 · XSS · basic

Published June 21, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

4.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVectors Team wpForo Forum allows Content Spoofing.This issue affects wpForo Forum: from n/a through 2.0.9.

Explanation of Vulnerability in Simple Terms

02Summary

wpForo Forum versions up to 2.0.9 contain a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts into forum content. An attacker with a user account can craft posts or messages containing JavaScript code that executes in other users' browsers when they view the affected content. This can lead to session hijacking, credential theft, or defacement of forum pages.

What an attacker can do

03Attacker Capabilities

Inject JavaScript code into forum posts that runs in other users' browsers.

Potential impact on your site

04Site Impact

Forum users' sessions and data are at risk; attackers can steal credentials or hijack accounts through malicious posts.

Conditions required to exploit

05Prerequisites

Attacker must have a registered user account on the forum.

Key dates

06Disclosure timeline

June 21, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-38055 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/80.html AskarLabs — CWE-80 write-up Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Related vulnerabilities