CVE-2026-120532: wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Reply Body in Moderation Forms

Q: Who can exploit this issue?

An attacker needs an authenticated WordPress account with at least Subscriber-level access. They can place malicious script content in the reply body through moderation forms.

Q: Who is at risk from a malicious reply?

Any user who accesses a page containing the injected reply may have the attacker’s script execute in their browser. The provided information does not limit exposure to a particular viewer role.

Q: Are installations running version 3.2.2 affected?

Yes. The issue affects wpForo Forum versions up to and including 3.2.2.

Published Nov 7, 2026

Updated

The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post[body]' parameter in all versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Event History

Nov 7, 2026

CVE Published

via MITRE·09:25 AM

Data Sourced

via MITRE·09:25 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs an authenticated WordPress account with at least Subscriber-level access. They can place malicious script content in the reply body through moderation forms.

Who is at risk from a malicious reply?

Any user who accesses a page containing the injected reply may have the attacker’s script execute in their browser. The provided information does not limit exposure to a particular viewer role.

Are installations running version 3.2.2 affected?

Yes. The issue affects wpForo Forum versions up to and including 3.2.2.

CVE-2026-120532: wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Reply Body in Moderation Forms

Event History

Frequently Asked Questions

Who can exploit this issue?

Who is at risk from a malicious reply?

Are installations running version 3.2.2 affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Who is at risk from a malicious reply?

Are installations running version 3.2.2 affected?