Description
wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows authenticated subscribers to upload SVG files as profile avatars through the avatar upload functionality. Attackers upload a crafted SVG containing CSS injection or JavaScript event handlers that execute in the browsers of any user who views the attacker's profile page.
Published: 2026-02-28
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stored Cross‑Site Scripting that allows execution of code in browsers when viewing an attacker’s avatar
Action: Immediate Patch
AI Analysis

Impact

wpForo Forum version 2.4.14 contains a stored cross‑site scripting vulnerability that can be triggered by uploading a malicious SVG file as a user avatar. The uploaded SVG may contain CSS or JavaScript that runs in the browser whenever any site visitor loads the avatar image. This leads to client‑side code execution with the privileges of the viewing user.

Affected Systems

The flaw exists in the GVectors Team wpForo Forum plugin, specifically in version 2.4.14. Versions 2.4.16 and later contain a fix, as indicated by the product data.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity, and the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in the KEV catalog. Exploitation requires an authenticated subscriber to upload a crafted SVG; any user who views the attacker’s profile will execute the injected code.

Generated by OpenCVE AI on April 17, 2026 at 13:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade wpForo Forum to version 2.4.16 or later to remove the vulnerable upload functionality.
  • Remove or replace any SVG avatar files that were uploaded before the upgrade, since they may contain malicious content.
  • Disable SVG uploads for avatars or enforce stricter MIME‑type validation until a secure implementation replaces the current logic.

Generated by OpenCVE AI on April 17, 2026 at 13:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Mar 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 04 Mar 2026 03:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:gvectors:wpforo_forum:*:*:*:*:*:wordpress:*:*

Mon, 02 Mar 2026 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Sat, 28 Feb 2026 22:00:00 +0000

Type Values Removed Values Added
Description wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows authenticated subscribers to upload SVG files as profile avatars through the avatar upload functionality. Attackers upload a crafted SVG containing CSS injection or JavaScript event handlers that execute in the browsers of any user who views the attacker's profile page.
Title wpForo Forum 2.4.14 Stored XSS via SVG Avatar File Upload
First Time appeared Gvectors
Gvectors wpforo Forum
Weaknesses CWE-79
CPEs cpe:2.3:a:gvectors:wpforo_forum:*:*:*:*:*:*:*:*
cpe:2.3:a:gvectors:wpforo_forum:2.4.16:*:*:*:*:*:*:*
Vendors & Products Gvectors
Gvectors wpforo Forum
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

Gvectors Wpforo Forum
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-03-06T15:14:09.929Z

Reserved: 2026-02-28T18:54:23.280Z

Link: CVE-2026-28558

cve-icon Vulnrichment

Updated: 2026-03-06T15:14:06.161Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-28T22:16:02.637

Modified: 2026-03-04T02:49:29.240

Link: CVE-2026-28558

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T14:00:15Z

Weaknesses