Description

The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'telegram' profile field in versions up to, and including, 3.1.6. This is due to insufficient input sanitization and output escaping in the profile_update action — the raw $_POST['data'] array is copied into a $custom_fields variable before validate() and sanitize() run, both of which operate only on a parallel $user reference, leaving $custom_fields unsanitized when it is persisted via update_custom_fields(); on render, wpforo_decode() reverses the entity encoding and the value is echoed without escaping in field_wrap_profile(). This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-25T08:16:41.707Z",
  "pubdate": "2026-09-25T08:16:41.707Z",
  "executiveSummary": "The wpForo Forum plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability residing within the user profile management module.\nThis vulnerability affects versions up to and including 3.1.6, allowing authenticated users with at least subscriber-level permissions to execute arbitrary JavaScript in the context of other users' sessions.\nThe flaw stems from improper handling of user-supplied data in the 'telegram' profile field, where unsanitized input is persisted to the database and subsequently rendered without adequate output encoding.\nSuccessful exploitation permits attackers to compromise user accounts, perform unauthorized actions, or exfiltrate sensitive session data, posing a significant risk to site integrity and user privacy.\nThe vulnerability is limited to authenticated actors, requiring at least subscriber access, but does not require administrative privileges to initiate the attack flow.",
  "technicalDetails": "The root cause of the vulnerability lies in a logic error within the profile_update action handling process. During the update procedure, the plugin initializes a $custom_fields variable by directly assigning the raw contents of the $_POST['data'] array. This occurs before the execution of the validation and sanitization routines, which are specifically architected to operate only on a parallel $user reference object rather than the $custom_fields variable itself.\nBecause the validation and sanitization functions fail to process the $custom_fields variable, the raw, potentially malicious payload is passed directly to the update_custom_fields() function. Consequently, the input is persisted in the WordPress database in its original, dangerous state. The vulnerability is specifically triggered by the 'telegram' profile field, which lacks the necessary oversight to enforce character stripping or entity encoding during the write phase.\nThe exploitation path further extends to the rendering layer. When the profile page is accessed, the field_wrap_profile() function invokes wpforo_decode() to reverse existing entity encoding. This decoded data is subsequently echoed directly to the DOM without further escaping or sanitization. This provides an execution context for injected scripts.\nAn attacker can exploit this by intercepting the profile update request and injecting a script tag or malicious event handler into the 'telegram' field value. Once saved, the payload remains dormant until a victim, such as a forum administrator or another user, views the compromised profile page. Upon rendering, the browser executes the injected JavaScript within the victim's session.\nThe impact is significant, as the injected script inherits the privileges of the victim's session. This allows for session hijacking, unauthorized modification of user profile data, or the redirection of users to malicious third-party domains. Since the script is stored within the application's persistent storage, it remains active until the payload is manually removed by an administrator or the database record is updated with sanitized content."
}