Description
Wikidforum 2.20 contains a cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted HTML in the reply_text parameter. Attackers can post comments containing JavaScript code through the rpc.php endpoint that executes in other users' browsers when viewing forum replies.
Published: 2026-05-29
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a stored cross‑site scripting flaw where an authenticated user can include malicious JavaScript in the reply_text parameter when posting a comment. When other users retrieve the reply via the rpc.php endpoint, the injected script is executed in their browsers.

Affected Systems

The flaw affects the Wikidforum application version 2.20. No other versions or vendors are listed, so any deployment of this product at that version is susceptible.

Risk and Exploitability

The CVSS score of 5.1 indicates a medium severity risk, and no EPSS estimate is available. The vulnerability can be exploited by any authenticated forum user and requires no special privileges, so the primary attack vector is the web application. Because the flaw is client‑side, the impact is limited to victims who view the malicious reply, but widespread use could affect many users. The flaw is not listed in CISA’s KEV catalog.

Generated by OpenCVE AI on May 29, 2026 at 17:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Wikidforum to a version that fixes the XSS flaw.
  • Implement server‑side sanitization or output encoding for the reply_text content before rendering to prevent script execution.
  • Deploy a web application firewall or similar controls to filter or block malicious scripts submitted via the rpc.php endpoint.

Generated by OpenCVE AI on May 29, 2026 at 17:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 29 May 2026 16:15:00 +0000

Type Values Removed Values Added
Description Wikidforum 2.20 contains a cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted HTML in the reply_text parameter. Attackers can post comments containing JavaScript code through the rpc.php endpoint that executes in other users' browsers when viewing forum replies.
Title Wikidforum 2.20 Cross-Site Scripting via reply_text Parameter
First Time appeared Wikidforum
Wikidforum wikidforum
Weaknesses CWE-79
CPEs cpe:2.3:a:wikidforum:wikidforum:*:*:*:*:*:*:*:*
Vendors & Products Wikidforum
Wikidforum wikidforum
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

Wikidforum Wikidforum
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-05-29T14:46:29.767Z

Reserved: 2026-05-29T11:12:10.931Z

Link: CVE-2018-25384

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-05-29T16:16:17.453

Modified: 2026-05-29T16:29:11.350

Link: CVE-2018-25384

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-29T18:00:05Z

Weaknesses