CVE-2026-72553
MediumCVSS 5.4Summary
A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persistent JavaScript into the profile fields cust_blurb and cust_locate. The fields are saved without HTML encoding and rendered unescaped in profile views visible to administrators. An attacker can execute code in an administrator session, enabling session hijacking or privilege escalation.
Risk Assessment
Administrator session hijacking and privilege escalation can lead to full forum compromise.
Recommendation
Update ElkArte Forum to a version that HTML-encodes profile fields.
Original NVD description (English source)
A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persistent JavaScript into the profile fields cust_blurb and cust_locate. The fields are saved without HTML encoding and rendered unescaped in profile views visible to administrators. An attacker can craft a payload that executes in an administrator session, enabling session hijacking or privilege escalation.