The wpForo + wpForo Advanced Attachments plugin for WordPress contains a stored cross‑site scripting vulnerability caused by insufficient sanitization of media upload filenames and lack of output escaping. When a user with Custom‑level access or above uploads a media file whose name contains malicious JavaScript, the filename is saved to the database and later rendered without escaping inside forum pages. Any user who views the affected page will have the injected script executed in their browser, enabling session hijacking, credential theft, defacement, or other client‑side attacks.

WordPress sites that employ the gVectors wpForo forum plugin together with wpForo Advanced Attachments version 3.1.3 or earlier are affected. The vulnerability applies only when a site allows users with Custom‑level or higher access to upload media files. Sites that restrict media uploads to lower‑level users or have already upgraded beyond 3.1.3 are not affected.

The CVSS score of 7.2 indicates a high severity, whereas the EPSS score of less than 1% suggests that automated exploitation is unlikely as of now. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only authenticated access by a user with Custom‑level or greater and the ability to craft a malicious filename. Because the required privilege level is often present in forum moderator or administrator accounts, the risk to high‑privilege users is significant despite the low EPSS. Prompt remediation is advised.