CVE-2026-28558: wpForo Forum 2.4.14 Stored XSS via SVG Avatar File Upload
wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows authenticated subscribers to upload SVG files as profile avatars through the avatar upload functionality. Attackers upload a crafted SVG containing CSS injection or JavaScript event handlers that execute in the browsers of any user who views the attacker's profile page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28558?
CVE-2026-28558 has been classified as a medium severity vulnerability due to its potential impact through stored XSS attacks.
How do I fix CVE-2026-28558?
To mitigate CVE-2026-28558, ensure that users cannot upload SVG files as profile avatars until a patch is applied.
Who is affected by CVE-2026-28558?
CVE-2026-28558 affects users of wpForo Forum version 2.4.14 and potentially any authenticated subscriber.
What type of vulnerability is CVE-2026-28558?
CVE-2026-28558 is classified as a stored cross-site scripting (XSS) vulnerability.
Can CVE-2026-28558 be exploited remotely?
Yes, CVE-2026-28558 can be exploited remotely by authenticated users through the avatar upload functionality.