VulnSocial

CVE-2026-28560Disclosure(gvectors / wpforo_forum)

LOWCVSS 4.8 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inline script block using json_encode without the JSON_HEX_TAG flag. Attackers set a forum slug containing a closing script tag or unescaped single quote to break out of the JavaScript string context and execute arbitrary script in all visitors' browsers.

gvectors CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • wpforo_forum

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 1 mentions (2026-02-28); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
gvectors
Products
wpforo_forum

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-02-28: 1Mentions · 2026-03-01: 1Technical Details · 2026-02-28: 1Technical Details · 2026-03-01: 102-2803-01
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
Full discourse2 posts
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-28560 Stored XSS in wpForo Forum 2.4.14 via Malicious Forum Slug Injection https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28560

    Post summary

    A stored XSS vulnerability (CVE-2026-28560) was disclosed in wpForo Forum 2.4.14, triggered by malicious forum slug injection.

    0000172
    4.0K followersView on X
  • CyberDudeBivash® | Global Cybersecurity Company@cyberbivash
    Disclosure

    🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-28560 - wpForo Forum 2.4.14 Stored XSS via Unsafe JSON Encoding in Inline Script Intel Report: https://ift.tt/ewANdD7

    Post summary

    A new stored XSS vulnerability (CVE-2026-28560) in wpForo Forum 2.4.14 has been disclosed, detailing unsafe JSON encoding in inline scripts.

    0000063
    343 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appgvectorswpforo_forum-wordpress-

Explore more

Back to dashboardgvectors CVEswpforo_forum vulnerabilities