CVE-2026-107422

Deferred Deferred - Pending Action

Stored XSS in WP w3all phpBB Integration Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: Patchstack

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in axew3.com WP w3all phpBB wp-w3all-phpbb-integration allows Stored XSS.This issue affects WP w3all phpBB: from n/a through 3.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-107422

EUVD

EUVD-2026-101012

Affected Vendors & Products

Vendor	Product	Version / Range
axew3.com	WP	w3all phpBB 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the WP w3all phpBB integration plugin for WordPress. It allows attackers to inject malicious scripts into web pages that are then stored on the server and served to other users. The flaw occurs due to improper neutralization of user input during web page generation.

Detection Guidance

This is a stored XSS vulnerability in the WP w3all phpBB integration plugin. Detection requires checking for malicious scripts in user inputs stored by the plugin, such as forum posts or profile fields. Manually review plugin files for suspicious JavaScript code in stored data. Use browser developer tools to inspect rendered pages for unexpected scripts.

Impact Analysis

An attacker could exploit this to steal user sessions, deface websites, or perform actions on behalf of users. It may lead to unauthorized data access, account takeovers, or spreading malware to visitors. The impact depends on user privileges and site configuration.

Compliance Impact

This vulnerability could violate GDPR by enabling unauthorized data access or processing. For HIPAA, it may risk protected health information exposure. Compliance failures may result in fines or legal penalties depending on data breaches caused by exploitation.

Mitigation Strategies

Update the WP w3all phpBB integration plugin to version 3.1.0 or later to address the Stored XSS vulnerability. If an update is not available, consider disabling the plugin temporarily until a patch is released.

Hi! I’m here to help you understand CVE-2026-107422. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70