CVE-2026-15021
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'location' Profile Field in all versions up to and including 3.1.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access or higher to inject arbitrary web scripts that execute whenever a user accesses an injected page.
Risk Assessment
An attacker can inject malicious JavaScript code that executes in the browsers of other users visiting the affected page, potentially leading to session theft, account takeover, or website defacement.
Recommendation
Immediately update the wpForo Forum plugin to the latest available version that includes a fix for this vulnerability. If an update is not available, temporarily disable the plugin or restrict editing of the 'location' field to trusted users only.
Other vulnerabilities in wpForo Forum
See all- CVE-2026-49767Critical
There is a vulnerability in wpForo Forum versions up to 3.1.0 related to unauthenticated broken authentication.
- CVE-2026-49769Critical
There is an unauthenticated PHP Object Injection vulnerability in wpForo Forum versions <= 3.1.0.
- CVE-2026-40798Critical
There is an unauthenticated SQL injection vulnerability in wpForo Forum versions up to 3.0.4.
- CVE-2026-42682Critical
The wpForo Forum plugin for WordPress has missing authorization, allowing exploitation of incorrectly configured access control security levels.
- CVE-2026-5097High
The wpForo Forum plugin for WordPress up to version 2.4.17 is vulnerable to SQL Injection via the 'referer' parameter. Insufficient escaping and lack of preparation on the SQL query allow unauthenticated attackers to append additional SQL queries, which can be used to extract sensitive information from the database.
- CVE-2026-12698Medium
The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing their own account. This allows subscriber-level users to write administrator-controlled account-state and reputation fields on their own profile, including self-activating a pending or banned account and forging their forum reputation score.
- CVE-2026-12696Medium
The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor who views the profile, including a logged-in administrator.
- CVE-2026-12697Medium
The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting user before deleting its messages, allowing users with a subscriber-level account to permanently delete the stored AI chat message history of any other user.
- CVE-2026-57636High
The wpForo Forum plugin version 3.0.9 and earlier contains a SQL injection vulnerability exploitable by contributors. An attacker with contributor privileges can inject malicious SQL queries, potentially leading to unauthorized database access.
- CVE-2026-40767High
wpForo Forum versions below 3.0.2 have an issue with unauthenticated access that leads to broken access control.
Original NVD description (English source)
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'location' Profile Field in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The sanitize_text_field() function applied at input does not encode double quotes, allowing attribute breakout via a payload that escapes the href attribute context and injects event handler attributes.