CVE-2026-28560
Received Received - Intake
Stored XSS in wpForo Forum 2.4.14 via Unsafe JSON Encoding

Publication date: 2026-02-28

Last updated on: 2026-03-04

Assigner: VulnCheck

Description
wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inline script block using json_encode without the JSON_HEX_TAG flag. Attackers set a forum slug containing a closing script tag or unescaped single quote to break out of the JavaScript string context and execute arbitrary script in all visitors' browsers.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-28
Last Modified
2026-03-04
Generated
2026-06-16
AI Q&A
2026-03-01
EPSS Evaluated
2026-06-14
NVD
CVE-2026-28560
EUVD
EUVD-2026-9109
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
gvectors wpforo_forum From 2.4.0 (inc) to 2.4.16 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability in wpForo Forum 2.4.14 is a stored cross-site scripting (XSS) issue. It occurs because the forum URL data is output into an inline script block using json_encode without the JSON_HEX_TAG flag. This allows attackers to inject malicious scripts by setting a forum slug that contains a closing script tag or an unescaped single quote, which breaks out of the JavaScript string context and enables execution of arbitrary scripts in the browsers of all visitors.

Impact Analysis

This vulnerability can impact users by allowing attackers to execute arbitrary scripts in the browsers of all visitors to the forum. This can lead to theft of sensitive information such as cookies or session tokens, unauthorized actions performed on behalf of users, defacement of the website, or distribution of malware.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-28560. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart