CVE-2026-12696

wpForo Forum < 3.1.2 - Subscriber+ Stored XSS via Profile Location Field

View on CVE.org
Published Aug 1, 2026 CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Description
The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor who views the profile, including a logged-in administrator.

Analysis

AI-generated

Technical impact

The wpForo Forum WordPress plugin before version 3.1.2 does not sanitize the profile Location field before outputting it inside an HTML attribute on the public participant profile page. Subscribers can insert malicious JavaScript that runs in the browsers of any visitor who views the profile, including logged‑in administrators. This stored XSS allows attackers to execute arbitrary client‑side code when the page is rendered.

Affected Systems

WordPress sites running the wpForo Forum plugin before version 3.1.2 are affected.

Risk and Exploitability

Although the EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, the presence of a stored XSS can be abused if a subscriber creates a malicious profile and a user—including a privileged user—views the profile. The exploitation requires only a subscriber account and exposure of the public profile page. The CVSS score is 5.4.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update wpForo Forum to version 3.1.2 or later to ensure the profile Location field is properly sanitized.
  • If a patch is not yet available, disable or remove the public display of the profile Location field through a custom code snippet or template modification.
  • Implement a strict Content‑Security‑Policy that blocks inline script execution originating from user input.

Generated by OpenCVE AI on August 4, 2026 at 23:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Wordpress-extensions
Wordpress-extensions wpforo Forum
Vendors & Products Wordpress-extensions
Wordpress-extensions wpforo Forum
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Weaknesses CWE-79
Type Values Removed Values Added
Description The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor who views the profile, including a logged-in administrator.
Title wpForo Forum < 3.1.2 - Subscriber+ Stored XSS via Profile Location Field
References
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
WPScan
Published
Updated
Aug 3, 2026, 6:53 PM
Reserved
Jun 19, 2026, 9:24 AM

View source JSON

Updated
Aug 3, 2026, 6:53 PM

JSON

Status
Deferred
Published
Aug 1, 2026, 7:16 AM
Modified
Aug 26, 2026, 4:31 PM

View source JSON

No data.

Updated
Nov 11, 2026, 9:42 AM

JSON