Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'location' Profile Field in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The sanitize_text_field() function applied at input does not encode double quotes, allowing attribute breakout via a payload that escapes the href attribute context and injects event handler attributes.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-15021 The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'location' Profile Field in all versions up to, and including, 3.1.1 due to ins… https://www.cve.org/CVERecord?id=CVE-2026-15021
Post summary
The text announces that wpForo version 3.1.1 and earlier suffer a stored XSS flaw via the 'location' profile field. No patch, PoC, or exploitation activity is mentioned.
🚨*CVE* CVE-2026-15021 The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'location' Profile Field in all versions up to, and including, 3.1.1 due to ins… https://www.cve.org/CVERecord?id=CVE-2026-15021 ----- Traducción: CVE-2026-15021 El … http://infoflow.cloud`
Post summary
The post announces the discovery of a stored XSS vulnerability in the wpForo WordPress plugin (CVE-2026-15021), providing technical details but no PoC, exploit code, or patch information.