Volerion logoVolerion
Volerion logoVolerion

wpForo Forum Stored Cross-Site Scripting Vulnerability

Vulnerability

A stored cross-site scripting vulnerability has been identified in wpForo Forum version 2.4.14. This vulnerability allows for script injection via forum URL data, which is output into an inline script block using json_encode without the JSON_HEX_TAG flag. Attackers can exploit this by including a closing script tag or an unescaped single quote in the forum slug, breaking out of the JavaScript string context and executing arbitrary scripts in the browsers of all visitors.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Remediation

Users can update to wpForo Forum version 2.4.16, which addresses this vulnerability by replacing json_encode with wp_json_encode to prevent script injection.

Added: Feb 28, 2026, 10:18 PM
Updated: Feb 28, 2026, 10:18 PM

Vulnerability Rating

Custom Algorithm
spread
5.2
impact
1.7
exploitability
5.2
remediation
7.7
relevance
3.3
threat
0.0
urgency
2.9
incentive
0.0

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.