The WP w3all phpBB plugin does not properly neutralize user input before rendering it into web pages. Consequently, malicious JavaScript can be stored in the plugin’s data fields and later executed in other users’ browsers, leading to theft of session cookies, credential leakage, or defacement of the site. This is a classic example of a Stored XSS flaw identified as CWE‑79.

WordPress sites running the axew3.com WP w3all phpBB plugin version 3.1.0 or earlier are susceptible. Any WordPress installation that has installed or upgraded to a non‑patched version of the plugin is in the danger zone until the fix is applied.

The vulnerability scores a CVSS score of 6.5, indicating a moderate severity. The EPSS score is < 1% (0.00182), and the flaw is not listed in CISA’s KEV catalog, which suggests that large‑scale exploitation has not been documented. However, because the flaw is stored, an attacker who can insert content via the plugin’s interface—whether through an authoring role or an injection via user input—could potentially compromise any visitor to the affected pages. The attack vector is likely through the plugin’s data entry points, as inferred from the stored nature of the flaw.