PT-2026-22479

CVE-2026-28558

·

Published

2026-02-28

·

Updated

2026-03-04

Description by

CVSS 3.1
6.4
Medium
MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions wpForo Forum version 2.4.14
Description The software contains a stored cross-site scripting issue that permits authenticated subscribers to upload specially crafted SVG files as profile avatars. This is achieved through the avatar upload functionality. An attacker can upload an SVG file containing CSS injection or JavaScript event handlers. These handlers execute in the browsers of users who view the attacker’s profile page.
Recommendations Update to a newer version that contains a fix for this vulnerability.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')
Related identifiers
CVE-2026-28558
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com