Stored Cross-Site Scripting in wpForo Forum Plugin for WordPress

CVE-2026-93747

What is CVE-2026-93747?

The wpForo Forum plugin for WordPress contains a vulnerability that allows for Stored Cross-Site Scripting through the ‘telegram’ profile field. This issue arises from improper input sanitization and output escaping during the profile update process. In versions 3.1.6 and earlier, the raw data can be directly stored without adequate validation, enabling attackers with subscriber-level access or higher to craft malicious scripts that execute when users interact with compromised profile pages. This poses a significant risk as it compromises the security of user data, making it critical for site administrators to update their plugins to the latest version.

References