CVE-2026-12696

Name of the Vulnerable Software and Affected Versions wpForo Forum WordPress plugin versions prior to 3.1.2

Description Insufficient sanitization and escaping of a user profile field occurs before it is output within an HTML attribute on the public participant profile page. This allows users with subscriber-level accounts to perform a Cross-Site Scripting (XSS) attack—a technique where malicious scripts are injected into trusted websites—by inserting JavaScript that executes in the browser of any visitor viewing the profile, including administrators.

Recommendations Update wpForo Forum WordPress plugin to version 3.1.2 or later.