The vulnerability in wpForo Forum allows an attacker to insert a malicious script into the forum slug field. The plugin outputs the slug inside a JavaScript string using json_encode without the JSON_HEX_TAG flag, enabling an attacker to close the string and inject executable script. Once a visitor loads a page containing the crafted slug, the attacker’s code runs in that visitor’s browser, potentially hijacking sessions or delivering malware.

WordPress sites that run wpForo Forum version 2.4.14 or earlier are affected. The plugin vendor, gVectors Team, has released a later version (2.4.16) that fixes the issue.

The CVSS score of 4.8 indicates moderate risk, while the EPSS score of less than 1% suggests the probability of exploitation is very low at this time. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, further lowering the likelihood of active exploitation. Inferentially, the attack vector requires the ability to create or edit a forum slug, which may be available to users with post‑moderation privileges or to anonymous users on some installations.