The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor who views the profile, including a logged-in administrator.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Wpforo Plugin | — | Update wpforo plugin to version 3.1.2, or a newer patched version | Aug 17, 2026 | Jul 20, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub