Stored Cross-Site Scripting Vulnerability in ForumWP Plugin for WordPress
CVE-2025-13746

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
ForumWP – Forum & Discussion Board
Vendor
CVE Published:
6 January 2026

What is CVE-2025-13746?

The ForumWP – Forum & Discussion Board plugin for WordPress is subject to a vulnerability due to improper input validation and output escaping. This issue allows authenticated users with Subscriber-level access and higher to embed malicious scripts through the User's Display Name. Once the script is injected, it will execute whenever other users visit the affected pages, potentially compromising their session data and web security.

Affected Version(s)

ForumWP – Forum & Discussion Board 0 <= 2.1.6

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/forumwp/tags/2...
https://plugins.trac.wordpress.org/browser/forumwp/tags/2...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sergej Ljubojevic
.