Volerion logoVolerion
Volerion logoVolerion

wpForo Forum Stored Cross-Site Scripting Vulnerability

Vulnerability

A stored cross-site scripting vulnerability has been identified in wpForo Forum version 2.4.14. This vulnerability allows administrators to inject persistent JavaScript into forum description fields, which are then echoed without proper output escaping across various theme template files. In multisite installations or with a compromised admin account, the injected scripts can execute when users view the forum listing.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the forum.

Remediation

Users are advised to update to wpForo Forum version 2.4.16, which addresses this vulnerability by fixing the output escaping issue in forum descriptions.

Added: Feb 28, 2026, 10:24 PM
Updated: Feb 28, 2026, 10:24 PM

Vulnerability Rating

Custom Algorithm
spread
5.2
impact
1.7
exploitability
4.7
remediation
7.7
relevance
3.5
threat
0.0
urgency
2.9
incentive
0.0

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.