Security Advisory

CVE-2026-28561

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2026-02-28 21:47:40

Last updated 2026-05-11 23:11:41

Assigner VulnCheck

State PUBLISHED

Description

wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows administrators to inject persistent JavaScript via forum description fields echoed without output escaping across multiple theme template files. On multisite installations or with a compromised admin account, attackers set a forum description containing HTML event handlers that execute when any user views the forum listing.

← Browse all CVEs View on cve.org ↗