wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inline script block using json_encode without the JSON_HEX_TAG flag. Attackers set a forum slug containing a closing script tag or unescaped single quote to break out of the JavaScript string context and execute arbitrary script in all visitors' browsers.
Metrics
Affected Vendors & Products
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Sat, 28 Feb 2026 22:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inline script block using json_encode without the JSON_HEX_TAG flag. Attackers set a forum slug containing a closing script tag or unescaped single quote to break out of the JavaScript string context and execute arbitrary script in all visitors' browsers. | |
| Title | wpForo Forum 2.4.14 Stored XSS via Unsafe JSON Encoding in Inline Script | |
| First Time appeared |
Gvectors
Gvectors wpforo Forum |
|
| Weaknesses | CWE-79 | |
| CPEs | cpe:2.3:a:gvectors:wpforo_forum:*:*:*:*:*:*:*:* cpe:2.3:a:gvectors:wpforo_forum:2.4.16:*:*:*:*:*:*:* |
|
| Vendors & Products |
Gvectors
Gvectors wpforo Forum |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-02-28T21:47:40.000Z
Reserved: 2026-02-28T18:54:23.281Z
Link: CVE-2026-28560
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-02-28T22:16:03.137
Modified: 2026-02-28T22:16:03.137
Link: CVE-2026-28560
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses