The wpForo Forum WordPress plugin allows an authenticated user with subscriber-level (or higher) privileges to inject malicious JavaScript into the post[body] field. This input is stored without proper sanitization or output escaping, resulting in stored cross‑site scripting that will execute in the browsers of any user who views the affected page. The flaw carries a CVSS score of 6.4, indicating moderate severity because it requires authenticated access but can lead to session hijacking, data theft, or defacement if the injected script runs for other visitors.

WordPress sites running the wpForo Forum plugin version 3.2.2 or any earlier release. The affected vendor is tomdever:wpForo Forum; all releases up to and including 3.2.2 contain the vulnerability. Up‑to‑date installations of version 3.2.3 or later are not impacted.

The CVSS score of 6.4 reflects a moderate likelihood of exploitation once valid credentials are in place. EPSS data is unavailable, so the current industry exploitation probability cannot be quantified, but the lack of a public exploit means the risk posture depends on the number of sites using vulnerable versions. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread, zero‑day exploit activity has been reported. Attackers would need to log in as a user with subscriber or higher privileges, navigate to the moderation form, and submit malicious script content in the reply body. Upon storage, the script will execute for every subsequent visitor who loads the page containing that reply.