Beveiligingsadvies

CVE-2026-28558

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-02-28 21:47:38

Laatst bijgewerkt 2026-05-11 23:11:38

Toegewezen door VulnCheck

CVSS-score 6.4

Status PUBLISHED

Beschrijving

wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows authenticated subscribers to upload SVG files as profile avatars through the avatar upload functionality. Attackers upload a crafted SVG containing CSS injection or JavaScript event handlers that execute in the browsers of any user who views the attacker's profile page.

← Alle CVE's bekijken Bekijk op cve.org ↗