CVE-2026-28561: wpForo Forum 2.4.14 Stored XSS via Unescaped Forum Description in Templates
wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows administrators to inject persistent JavaScript via forum description fields echoed without output escaping across multiple theme template files. On multisite installations or with a compromised admin account, attackers set a forum description containing HTML event handlers that execute when any user views the forum listing.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28561?
CVE-2026-28561 is classified as a high-severity stored cross-site scripting (XSS) vulnerability.
How do I fix CVE-2026-28561?
To fix CVE-2026-28561, update wpForo Forum to the latest version where this vulnerability has been addressed.
Who is affected by CVE-2026-28561?
CVE-2026-28561 affects installations of wpForo Forum version 2.4.14 and potentially earlier versions.
What kind of attack can be executed using CVE-2026-28561?
An attacker can exploit CVE-2026-28561 to inject malicious JavaScript into the forum, which can execute in the context of other users' browsers.
Is CVE-2026-28561 a client-side or server-side vulnerability?
CVE-2026-28561 is primarily a client-side vulnerability, as it involves executing scripts in the users' browsers.