A stored cross-site scripting vulnerability in the wpForo Forum plugin for WordPress permits authenticated subscribers to execute malicious scripts, posing a risk of session hijacking and unauthorized actions.

This vulnerability is a cross-site scripting (CWE-79) flaw that allows an authenticated user with subscriber-level privileges to inject malicious scripts into the forum environment. The input is not properly neutralized before being rendered in the web page, enabling execution within the context of other users, including administrators.

The exploitation of this flaw could lead to the theft of session cookies or the performance of unauthorized actions on behalf of site administrators, potentially resulting in full site compromise. With a CVSS score of 6.5, this medium-severity issue represents a significant risk to the integrity and confidentiality of the forum platform, necessitating prompt remediation to prevent account takeovers.

Immediate Action: Update the WordPress wpForo Forum plugin to version 3.1.6 or the latest available version provided by the vendor.

Proactive Monitoring: Monitor site traffic and server logs for suspicious script injections or unauthorized requests originating from subscriber accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common XSS payloads directed at the forum interface.

Public Exploit Available: Unknown

Organizations utilizing the wpForo Forum plugin should prioritize updating to version 3.1.6 immediately to eliminate the risk of script injection. Failure to apply this patch leaves the platform vulnerable to malicious actors who may leverage subscriber accounts to escalate privileges or exfiltrate sensitive user data.