Executive brief
The wpForo Forum plugin for WordPress, which adds community discussion features to websites, contains a security flaw in its user profile settings. An attacker with a basic user account can save malicious code into their 'location' profile field. This code will then automatically run in the browsers of other users or administrators who view the attacker's profile, potentially allowing the attacker to perform unauthorized actions or steal session information.
Technical details
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'location' profile field in versions up to 3.1.1. The vulnerability exists because the sanitize_text_field() function used during input does not encode double quotes, allowing an attacker to break out of the HTML attribute context (specifically the href attribute). Authenticated attackers with subscriber-level permissions or higher can inject arbitrary web scripts that execute when other users view the affected profile page. This is a stored XSS vulnerability resulting from insufficient input sanitization and output escaping.
Affected products
- tomdever wpForo Forum up to, and including, 3.1.1
Timeline
- 2026-07-16: disclosed
- 2026-07-16: advisory
References
- https://plugins.trac.wordpress.org/browser/wpforo/tags/3.0.5/classes/Forms.php
- https://plugins.trac.wordpress.org/browser/wpforo/tags/3.0.5/classes/Forms.php
- https://plugins.trac.wordpress.org/browser/wpforo/tags/3.0.5/classes/Members.php
- https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.1/classes/Forms.php
- https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.1/classes/Forms.php
- https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.1/classes/Members.php
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3603849%40wpforo&new=3603849%40wpforo