What the vulnerability does
01Description
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'location' Profile Field in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The sanitize_text_field() function applied at input does not encode double quotes, allowing attribute breakout via a payload that escapes the href attribute context and injects event handler attributes.
Explanation of Vulnerability in Simple Terms
02Summary
wpForo Forum versions 3.1.1 and earlier contain a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts affecting other users across the site. The vulnerability requires a valid user account but no additional user interaction. An attacker can steal session tokens, deface content, or redirect users to malicious sites.
What an attacker can do
03Attacker Capabilities
Inject malicious JavaScript that executes in other users' browsers and affects site-wide functionality.
Potential impact on your site
04Site Impact
Forum users' sessions and data are at risk; attackers can impersonate users or steal sensitive information.
Conditions required to exploit
05Prerequisites
Attacker must have a valid user account on the forum (low privilege level required).
Key dates
06Disclosure timeline
July 16, 2026
CVE published
July 16, 2026
Record updated
