wpForo Forum Plugin Vulnerability (CVE-2026-93747)

1 month ago

On this page

Security Alert Summary

The wpForo Forum plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability in the handling of the “telegram” profile field. Authenticated users with subscriber-level access and above can inject scripts that are stored and later executed when other users view the affected profile output, due to incomplete input sanitization and missing output escaping.

CVE Details

CVE ID: CVE-2026-93747
Affected component: wpForo Forum plugin (profile handling)
Affected versions: versions up to and including 3.1.6
Published: September 25, 2026 at 08:16:41 AM UTC
Last modified: September 25, 2026 at 02:17:23 PM UTC
CVSS v3.1: Base Score 6.4, Severity MEDIUM, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Authentication / privileges / user interaction: Requires an authenticated user; privileges required: low (subscriber-level and above as noted in the description); user interaction: none
Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation)

Technical Details

The vulnerability is a stored Cross-Site Scripting (XSS) issue that arises from insufficient input sanitization and missing output escaping in the profile update and render flow.

Specifically, the raw $_POST['data'] array is copied into a $custom_fields variable before validation and sanitization occur. The plugin’s validate() and sanitize() routines operate only on a parallel $user reference, leaving $custom_fields unsanitized when it is persisted via update_custom_fields(). Later, on render, wpforo_decode() reverses entity encoding and the value is echoed without escaping in field_wrap_profile(). The vulnerable profile field named in the report is the “telegram” field.

Because the stored value is output without proper escaping, an authenticated attacker with subscriber-level access or higher can store arbitrary script content that will execute in the browser of users who view the injected profile output.

How This Could Impact Your Website

Consider a site with multiple WordPress users: a site owner, internal staff who moderate forum content, and external contributors or contractors who update profile information. An authenticated forum user with subscriber-level privileges could inject a script into their “telegram” profile field. When other users, including staff or site administrators who view the injected profile page, load that page, the script may run in their browsers.

Practical consequences include exposure of session information visible to the attacker in the victim’s browser context, disclosure of profile data such as internal user email addresses if those pages are viewed, and an increased risk of targeted phishing or social engineering against staff members. The impact aligns with low confidentiality and integrity impacts as reported; it does not indicate direct site takeover or availability loss.

If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.

Recommended Actions

Update the affected plugin as soon as a patched version is available.
Review and reduce unnecessary user roles and capabilities, especially for contributors and subscribers.
Enforce strong passwords and enable two-factor authentication for editors and administrators.
Remove unused or unmaintained plugins and audit plugin sources.
Monitor site activity and logs for unusual behavior, including unexpected profile changes or new script elements in stored content.

If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

Nick Paliughi https://freshysites.com/team/nick-paliughi/

Nick was born in California and now resides in Lake Worth, FL. He has 10 years of experience building and maintaining sites in WordPress, which he is excited to put to use at Freshy. Prior to starting at Freshy in 2022 his focus was on WordPress security & malware removal. When he’s not tending to your website, Nick is installing exhibitions at art galleries and museums in Palm Beach County, and if he’s lucky surfing at the Lake Worth pier.