The wpForo Forum plugin permits users who are logged in with at least subscriber privilege to store malicious script in the "location" profile field. The input undergoes sanitization that does not escape double quotes, enabling the attacker to break out of the href attribute context and inject event‑handler attributes. When the profile is displayed, the embedded script executes in the victim’s browser, which can lead to cookie theft, phishing, or execution of arbitrary client‑side code. This is a classic XSS flaw identified as CWE‑79.

All releases of the wpForo Forum plugin for WordPress up to and including version 3.1.1 are affected. The flaw appears on any site that has the plugin installed and a user with subscriber or higher role. No specific external dependencies are required beyond the presence of the plugin in the WordPress installation.

The CVSS score of 6.4 indicates a medium severity. The EPSS score of less than 1% signals a low likelihood of exploitation at the present moment, and the vulnerability is not listed in CISA KEV. Nevertheless, an attacker must only be authenticated with a subscriber‑level account and supply a specially crafted payload; no server‑side code execution is necessary. Once injected, the script runs automatically whenever the profile page is accessed, providing a persistent threat vector against all users who view the page.