# CVE-2026-15021: wpForo Forum Stored XSS in location Profile Field

Source: https://junglewise.ai/threats/cve-2026-15021-wpforo-forum-stored-xss-in-location-profile-field  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-15021 · Severity: medium · CVSS 6.4 · Published 2026-07-16

The wpForo Forum plugin for WordPress, which adds community discussion features to websites, contains a security flaw in its user profile settings. An attacker with a basic user account can save malicious code into their 'location' profile field. This code will then automatically run in the browsers of other users or administrators who view the attacker's profile, potentially allowing the attacker to perform unauthorized actions or steal session information.

Technologies: [gVectors Team wpForo Forum](https://junglewise.ai/threats/technologies/wpforo-forum). Vendors: [gVectors Team](https://junglewise.ai/threats/vendors/gvectors-team).

## Quick answers

**Is CVE-2026-15021 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15021 being exploited in the wild.

**How severe is CVE-2026-15021?** Medium severity, with a CVSS score of 6.4, published 16 July 2026.

**Which products and versions are affected?** gVectors Team wpForo Forum up to, and including, 3.1.1.

**Is there a fix for CVE-2026-15021?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15021 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-15021?** Check whether you run gVectors Team wpForo Forum at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'location' profile field in versions up to 3.1.1. The vulnerability exists because the sanitize_text_field() function used during input does not encode double quotes, allowing an attacker to break out of the HTML attribute context (specifically the href attribute). Authenticated attackers with subscriber-level permissions or higher can inject arbitrary web scripts that execute when other users view the affected profile page. This is a stored XSS vulnerability resulting from insufficient input sanitization and output escaping.

## Affected products

- tomdever wpForo Forum up to, and including, 3.1.1

## Timeline

- 2026-07-16: disclosed
- 2026-07-16: advisory

## References

- [https://plugins.trac.wordpress.org/browser/wpforo/tags/3.0.5/classes/Forms.php](https://plugins.trac.wordpress.org/browser/wpforo/tags/3.0.5/classes/Forms.php)
- [https://plugins.trac.wordpress.org/browser/wpforo/tags/3.0.5/classes/Forms.php](https://plugins.trac.wordpress.org/browser/wpforo/tags/3.0.5/classes/Forms.php)
- [https://plugins.trac.wordpress.org/browser/wpforo/tags/3.0.5/classes/Members.php](https://plugins.trac.wordpress.org/browser/wpforo/tags/3.0.5/classes/Members.php)
- [https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.1/classes/Forms.php](https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.1/classes/Forms.php)
- [https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.1/classes/Forms.php](https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.1/classes/Forms.php)
- [https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.1/classes/Members.php](https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.1/classes/Members.php)
- [https://plugins.trac.wordpress.org/changeset?reponame=&old=3603849%40wpforo&new=3603849%40wpforo](https://plugins.trac.wordpress.org/changeset?reponame=&old=3603849%40wpforo&new=3603849%40wpforo)

## Related threats

- [wpForo Forum stored XSS in user profile field](https://junglewise.ai/threats/cve-2026-12696-wpforo-forum-stored-xss-in-user-profile-field)
- [wpForo Forum IDOR in AI chat message deletion](https://junglewise.ai/threats/cve-2026-12697-wpforo-forum-idor-in-ai-chat-message-deletion)
- [Tomdever wpForo Forum SQL injection](https://junglewise.ai/threats/cve-2026-57636-tomdever-wpforo-forum-sql-injection)
- [Tomdever wpForo Forum authentication bypass](https://junglewise.ai/threats/cve-2026-49767-tomdever-wpforo-forum-authentication-bypass)
- [gVectors wpForo Forum PHP object injection](https://junglewise.ai/threats/cve-2026-49769-gvectors-wpforo-forum-php-object-injection)