CVE-2026-15021

Name of the Vulnerable Software and Affected Versions wpForo Forum plugin for WordPress versions prior to 3.1.2

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts into pages. The issue resides in the location profile field, where the sanitize text field() function fails to encode double quotes. This allows an attacker to break out of the href attribute context and inject event handler attributes, which execute when a user accesses the affected page.

Recommendations Update the plugin to version 3.1.2 or later. As a temporary mitigation, restrict the ability of subscriber-level users to edit the location profile field.