CVE-2026-93747: wpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'telegram' profile field in versions up to, and including, 3.1.6. This is due to insufficient input sanitization and output escaping in the profileupdate action — the raw $POST['data'] array is copied into a $customfields variable before validate() and sanitize() run, both of which operate only on a parallel $user reference, leaving $customfields unsanitized when it is persisted via updatecustomfields(); on render, wpforodecode() reverses the entity encoding and the value is echoed without escaping in fieldwrapprofile(). This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with at least Subscriber-level access. They can place malicious script content in the wpForo Telegram profile field.
When does the injected script execute?
The script is stored in the affected profile field and executes when a user accesses a page that renders the injected value. The issue can affect users who view the attacker's profile content.
How can I determine whether my site is affected?
Sites using gVectors wpForo Forum version 3.1.6 or earlier are affected. Review Telegram profile-field values for unexpected HTML or script-like content, especially for accounts with Subscriber access.