CVE-2026-28560
Received Received - Intake

Stored XSS in wpForo Forum 2.4.14 via Unsafe JSON Encoding

Publication date: 2026-02-28

Last updated on: 2026-03-04

Assigner: VulnCheck

Description
wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inline script block using json_encode without the JSON_HEX_TAG flag. Attackers set a forum slug containing a closing script tag or unescaped single quote to break out of the JavaScript string context and execute arbitrary script in all visitors' browsers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-28
Last Modified
2026-03-04
Generated
2026-07-06
AI Q&A
2026-03-01
EPSS Evaluated
2026-07-05
NVD
CVE-2026-28560
EUVD
EUVD-2026-9109

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gvectors wpforo_forum From 2.4.0 (inc) to 2.4.16 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in wpForo Forum 2.4.14 is a stored cross-site scripting (XSS) issue. It occurs because the forum URL data is output into an inline script block using json_encode without the JSON_HEX_TAG flag. This allows attackers to inject malicious scripts by setting a forum slug that contains a closing script tag or an unescaped single quote, which breaks out of the JavaScript string context and enables execution of arbitrary scripts in the browsers of all visitors.

Impact Analysis

This vulnerability can impact users by allowing attackers to execute arbitrary scripts in the browsers of all visitors to the forum. This can lead to theft of sensitive information such as cookies or session tokens, unauthorized actions performed on behalf of users, defacement of the website, or distribution of malware.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-28560. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart