CVE-2026-12696
wpForo Forum < 3.1.2 - Subscriber+ Stored XSS via Profile Location Field
CVSS Score
5.4
EPSS Score
0.2%
EPSS Percentile
5th
The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor who views the profile, including a logged-in administrator.
| Vendor | unknown |
| Product | wpforo forum |
| Published | Aug 1, 2026 |
| Last Updated | Aug 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wpforo forum
Be the first to know when new medium vulnerabilities affecting unknown wpforo forum are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / wpForo Forum
0 < 3.1.2
References
Credits
Revanth Hari Narayana Matte WPScan