CVE-2026-107422: WordPress WP w3all phpBB plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in axew3.com WP w3all phpBB wp-w3all-phpbb-integration allows Stored XSS.This issue affects WP w3all phpBB: from n/a through 3.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WP w3all phpBB pluginto a version that resolves this vulnerability.Fixed in 3.1.2
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attack vector indicates that an attacker needs low-level privileges. Exploitation also requires user interaction.
Which deployments are affected?
The issue affects WP w3all phpBB versions through 3.1.0. The provided information does not identify a configuration-specific prerequisite.
What could successful exploitation allow?
This is a stored cross-site scripting issue. The supplied vector indicates low impact to confidentiality, integrity, and availability, with scope changed.