CVE-2026-78293
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Unauthenticated XSS vulnerability in WP w3all phpBB versions up to 3.0.6. An attacker can inject malicious script that executes in the victim's browser.
Risk Assessment
Risk of session theft, account takeover, or malware distribution.
Recommendation
Update the WP w3all phpBB plugin to the latest version. Additionally, apply input filtering and output encoding.
Other vulnerabilities in WP w3all phpBB
See all- CVE-2026-107422Medium
The WP w3all phpBB plugin (axew3.com) in versions up to 3.1.0 contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation.
- CVE-2026-73998High
SQL Injection vulnerability in WP w3all phpBB plugin versions up to 3.0.5, exploitable by a user with Subscriber role. A low-privileged user can inject SQL queries into the database.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in WP w3all phpBB <= 3.0.6 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS