CVE-2026-78293

HighCVSS 7.1

Published: 27/08/2026(UTC)Updated: 28/08/2026(UTC)Translated: 27/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

Unauthenticated XSS vulnerability in WP w3all phpBB versions up to 3.0.6. An attacker can inject malicious script that executes in the victim's browser.

Risk Assessment

Risk of session theft, account takeover, or malware distribution.

Recommendation

Update the WP w3all phpBB plugin to the latest version. Additionally, apply input filtering and output encoding.

Other vulnerabilities in WP w3all phpBB

CVE-2026-73998High
SQL Injection vulnerability in WP w3all phpBB plugin versions up to 3.0.5, exploitable by a user with Subscriber role. A low-privileged user can inject SQL queries into the database.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in WP w3all phpBB <= 3.0.6 versions.