What’s Vulnerable › Vulnerabilities

CVE-2026-28561: wpForo Forum 2.4.14 Stored XSS via Unescaped Forum Description in Templates

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-28 · updated 2026-06-17
• Weakness: CWE-79

Description

wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows administrators to inject persistent JavaScript via forum description fields echoed without output escaping across multiple theme template files. On multisite installations or with a compromised admin account, attackers set a forum description containing HTML event handlers that execute when any user views the forum listing.

Affected products

• tomdever wpForo Forum: from 2.4.0 before 2.4.16 — fixed in 2.4.16

How to fix

Upgrade to a fixed version: tomdever wpForo Forum 2.4.16. Check the vendor advisory for mitigations.

References

• https://wordpress.org/plugins/wpforo/
• https://wordpress.org/plugins/wpforo/#developers
• https://www.vulncheck.com/advisories/wpforo-forum-stored-xss-via-unescaped-forum-description-in-templates

Get alerted when CVE-2026-28561 or the next vulnerability affects your stack