Vulnerability Description
wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inline script block using json_encode without the JSON_HEX_TAG flag. Attackers set a forum slug containing a closing script tag or unescaped single quote to break out of the JavaScript string context and execute arbitrary script in all visitors' browsers.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gvectors | Wpforo Forum | >= 2.4.0, < 2.4.16 |
Related Weaknesses (CWE)
References
- https://wordpress.org/plugins/wpforo/Product
- https://wordpress.org/plugins/wpforo/#developersRelease Notes
- https://www.vulncheck.com/advisories/wpforo-forum-stored-xss-via-unsafe-json-encThird Party Advisory
FAQ
What is CVE-2026-28560?
CVE-2026-28560 is a vulnerability with a CVSS score of 5.5 (MEDIUM). wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inline script block using json_encode without the JSON_HEX_TAG f...
How severe is CVE-2026-28560?
CVE-2026-28560 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-28560?
Check the references section above for vendor advisories and patch information. Affected products include: Gvectors Wpforo Forum.