Executive brief
ElkArte Forum is an open-source discussion platform used to host online communities. A stored XSS vulnerability allows any registered user to inject malicious JavaScript into their profile fields (blurb and location), which executes when administrators view the attacker's profile. An attacker can exploit this to hijack administrator sessions or gain unauthorized administrative privileges.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in ElkArte Forum 2.0 Beta 1, where user-supplied input in the profile fields cust_blurb and cust_locate is saved to the database without HTML encoding and rendered unescaped during profile view rendering. The vulnerability requires the attacker to be a registered forum member, and the payload executes in the context of an administrator's session when they view the attacker's profile. This enables session hijacking and privilege escalation attacks. A patch or update to properly HTML-encode these fields would mitigate the issue.
Affected products
- ElkArte Forum 2.0 Beta 1
Timeline
- 2026-08-11: disclosed