CVE-2026-72553

MediumCVSS 5.4

Published: 11/08/2026(UTC)Updated: 03/09/2026(UTC)Translated: 11/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Summary

A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persistent JavaScript into the profile fields cust_blurb and cust_locate. The fields are saved without HTML encoding and rendered unescaped in profile views visible to administrators. An attacker can execute code in an administrator session, enabling session hijacking or privilege escalation.

Risk Assessment

Administrator session hijacking and privilege escalation can lead to full forum compromise.

Recommendation

Update ElkArte Forum to a version that HTML-encodes profile fields.

Other vulnerabilities in ElkArte Forum

CVE-2024-58295High
ElkArte Forum 1.1.9 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the theme installation process. Attackers can upload a ZIP archive with a PHP file containing system commands, which can then be executed by accessing the uploaded file in the theme directory.

Original NVD description (English source)

A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persistent JavaScript into the profile fields cust_blurb and cust_locate. The fields are saved without HTML encoding and rendered unescaped in profile views visible to administrators. An attacker can craft a payload that executes in an administrator session, enabling session hijacking or privilege escalation.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS