medium5.4
CVE-2026-12696
The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public pa…
Impact
The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor who views the profile, including a logged-in administrator.
Affected products
| Product | Affected versions |
|---|---|
| WpForo Forum WordPress Plugin | before 3.1.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.