The wpForo Forum plugin version 2.4.14 has a stored cross‑site scripting flaw that allows an administrator to inject persistent JavaScript into forum descriptions. Because the plugin echoes these descriptions without escaping across multiple theme template files, the malicious script runs automatically whenever a user views the forum listing. This may facilitate browser‑side attacks that rely on the victim’s context; based on the description, it is inferred that such attacks could include cookie theft, session hijacking, or defacement.

The vulnerability affects installations of the gVectors Team's wpForo Forum WordPress plugin version 2.4.14. It is also relevant for multisite WordPress configurations or sites where an attacker has gained administrative privileges, as the malicious JavaScript is embedded in stored forum descriptions.

The CVSS v3.1 score of 4.8 denotes a moderate severity, while an EPSS score of less than 1 % indicates a low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. Attackers would need administrative access to create the malicious forum description or an exploited multisite site could expose all users to the stored XSS. Once executed, the payload can be used for numerous browser‑side attacks, but it does not provide remote code execution on the server itself.