CVE-2018-25384

Wikidforum 2.20 Cross-Site Scripting via reply_text Parameter

Published May 29, 2026 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Description

Wikidforum 2.20 contains a cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted HTML in the reply_text parameter. Attackers can post comments containing JavaScript code through the rpc.php endpoint that executes in other users' browsers when viewing forum replies.

Analysis

Technical impact

The vulnerability is a stored cross‑site scripting flaw where an authenticated user can include malicious JavaScript in the parameter when posting a comment. When other users retrieve the reply via the rpc.php endpoint, the injected script is executed in their browsers.

Affected Systems

The flaw affects the Wikidforum application version 2.20. No other versions or vendors are listed, so any deployment of this product at that version is susceptible.

Risk and Exploitability

The CVSS score of 5.1 indicates a medium severity risk, and the EPSS estimate is < 1%, indicating a very low probability of exploitation. The vulnerability can be exploited by any authenticated forum user and requires no special privileges, so the primary attack vector is the web application. Because the flaw is client‑side, the impact is limited to victims who view the malicious reply, but widespread use could affect many users. The flaw is not listed in CISA’s KEV catalog.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

wikidforum

Wikidforum

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.20

No data.

Vendor Product Versions

Wikidforum

Version	Status	Scheme	Platform
`[0,2.2.0]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Wikidforum to a version that fixes the XSS flaw.
Implement server‑side sanitization or output encoding for the reply_text content before rendering to prevent script execution.
Deploy a web application firewall or similar controls to filter or block malicious scripts submitted via the rpc.php endpoint.

Generated by OpenCVE AI on June 10, 2026 at 02:23 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.215% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://sourceforge.net/projects/wikidforum/
https://sourceforge.net/projects/wikidforum/files/Wikidforum-com-ed.2.20.zip/download
https://www.exploit-db.com/exploits/45580
https://www.vulncheck.com/advisories/wikidforum-cross-site-scripting-via-reply-text-parameter

History

Jun 10, 2026 1:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV4_0 `{'score': 4.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}`	cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}`

Jun 4, 2026 2:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}`	cvssV4_0 `{'score': 4.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}`

Jun 3, 2026 10:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 29, 2026 4:15 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Wikidforum 2.20 contains a cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted HTML in the reply_text parameter. Attackers can post comments containing JavaScript code through the rpc.php endpoint that executes in other users' browsers when viewing forum replies.
Title		Wikidforum 2.20 Cross-Site Scripting via reply_text Parameter
First Time appeared		Wikidforum Wikidforum wikidforum
Weaknesses		CWE-79
CPEs		cpe:2.3:a:wikidforum:wikidforum::::::::
Vendors & Products		Wikidforum Wikidforum wikidforum
References		https://sourceforge.net/projects/wikidforum/ https://sourceforge.net/projects/wikidforum/files/Wikidforum-com-ed.2.20.zip/download https://www.exploit-db.com/exploits/45580 https://www.vulncheck.com/advisories/wikidforum-cross-site-scripting-via-reply-text-parameter
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}` cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}`