Stored Cross-Site Scripting Vulnerability in wpForo Plugin by WordPress
CVE-2025-4224
7.2HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 3 June 2025
What is CVE-2025-4224?
The wpForo + wpForo Advanced Attachments plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping of media upload names. This vulnerability allows authenticated attackers with Custom-level access or higher to inject malicious web scripts into pages. When these manipulated pages are accessed by users, the injected scripts execute, potentially compromising user data and site integrity.
Affected Version(s)
wpForo + wpForo Advanced Attachments * <= 3.1.3