CVE-2026-107422
MediumCVSS 6.5Summary
The WP w3all phpBB plugin (axew3.com) in versions up to 3.1.0 contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation.
Risk Assessment
An attacker may inject a malicious script that is stored and executed in other users' browsers, potentially leading to session or data theft.
Recommendation
Update the WP w3all phpBB plugin to a version later than 3.1.0 once a fix is available, and consider implementing additional content filters.
Other vulnerabilities in WP w3all phpBB
See all- CVE-2026-73998High
SQL Injection vulnerability in WP w3all phpBB plugin versions up to 3.0.5, exploitable by a user with Subscriber role. A low-privileged user can inject SQL queries into the database.
- CVE-2026-78293High
Unauthenticated XSS vulnerability in WP w3all phpBB versions up to 3.0.6. An attacker can inject malicious script that executes in the victim's browser.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in axew3.com WP w3all phpBB wp-w3all-phpbb-integration allows Stored XSS.This issue affects WP w3all phpBB: from n/a through 3.1.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS