Stored Cross-Site Scripting Vulnerability in wpForo Forum Plugin for WordPress

CVE-2026-120532

What is CVE-2026-120532?

The wpForo Forum plugin for WordPress is susceptible to Stored Cross-Site Scripting via the 'post[body]' parameter in all versions up to 3.2.2. This vulnerability arises from inadequate input sanitization and output escaping processes. Authenticated attackers with subscriber-level access can inject harmful web scripts into pages, which, when accessed by users, could execute the malicious code, leading to unauthorized access or data exposure. Ensuring that the plugin is updated and proper security measures are in place is essential to mitigate such risks.

References