CVE-2026-120532

Name of the Vulnerable Software and Affected Versions wpForo Forum versions prior to 3.2.3

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts via the post[body] parameter, which then execute when a user visits the affected page.

Recommendations Update to a version newer than 3.2.2. Avoid using the post[body] parameter for untrusted input until the update is applied.