CVE-2026-28560

MEDIUM

5.5

Beschreibung

wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inline script block using json_encode without the JSON_HEX_TAG flag. Attackers set a forum slug containing a closing script tag or unescaped single quote to break out of the JavaScript string context and execute arbitrary script in all visitors' browsers.

CVE Details

CVSS v3.1 Bewertung5.5

SchweregradMEDIUM

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienHIGH

BenutzerinteraktionNONE

Veroffentlicht2/28/2026

Zuletzt geandert3/4/2026

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

gvectors:wpforo_forum

Schwachen (CWE)

CWE-79

Referenzen

https://wordpress.org/plugins/wpforo/(disclosure@vulncheck.com)

https://wordpress.org/plugins/wpforo/#developers(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/wpforo-forum-stored-xss-via-unsafe-json-encoding-in-inline-script(disclosure@vulncheck.com)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.