CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
What the vulnerability does
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Explanation of Vulnerability in Simple Terms
wpForo Forum versions up to 2.4.5 contain a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts. An attacker with forum access can craft a request that, when visited by another user, executes JavaScript in their browser. This can lead to session hijacking, credential theft, or unauthorized actions on behalf of the victim.
What an attacker can do
Inject and execute JavaScript in other users' browsers to steal sessions or perform actions as them.
Potential impact on your site
Forum users' accounts and data are at risk if they interact with content posted by attackers.
Conditions required to exploit
Attacker must have a forum account (low privilege). Victim must visit a page containing the malicious payload.
Key dates
External resources
