This vulnerability allows an authenticated user with subscriber‑level access or higher in the Discussion Board WordPress forum plugin to store malicious scripts in the user profile Website (user_url) field. The flaw resides in the ctdb_filter_comment_author_name() callback, which interpolates the raw URL into a single‑quoted href attribute without proper escaping. As a result, any discussion thread containing the attacker’s reply will execute the injected script for any user who views that thread, potentially compromising user sessions or exfiltrating data. The primary impact is the ability to run arbitrary client‑side code in the context of the website for users visiting the affected threads.

All installations of the MarketingFire Discussion Board – WordPress Forum Plugin version 2.6.0 and earlier are affected. The issue is confined to the website field of the user profile when comments are displayed via the get_comment_author_link hook.

The CVSS score of 6.4 classifies the threat as moderate, and no EPSS score is currently available. The vulnerability is not listed in the CISA KEV catalog, but it can be exploited by any authenticated user with subscriber access, a common privilege level in many sites, making the risk higher for widespread deployments. The known attack vector is authenticating to the site and posting a comment containing malicious JavaScript. Once a forum thread containing the comment is accessed by others, the script executes in their browsers, potentially allowing for cookie theft, session hijacking, or other client‑side abuse.