The wpForo Forum plugin for WordPress contains a stored XSS vulnerability in its 'telegram' profile field that can be abused by authenticated users with subscriber‑level or higher access. The flaw arises because the plugin copies raw POST data into a variable before sanitization, bypassing output escaping when the profile field is rendered. An attacker can embed malicious JavaScript that will execute in the browsers of any visitor to pages that display the affected profile, potentially compromising session tokens, defacing content, or injecting further payloads.

Affected systems are sites running Tomdever's wpForo Forum plugin for WordPress, versions up to and including 3.1.6. Any installation within that release range is vulnerable; versions newer than 3.1.6 are not confirmed to be affected.

The vulnerability carries a CVSS score of 6.4, indicating a moderate risk. EPSS is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires the target to be logged in as a subscriber or higher, so the attack surface depends on the presence of such users. The stored nature means the injected payload persists and affects all users who view the compromised profile, making it a persistent threat. Given its medium severity and the potential impact on many users, timely remediation is advised.