{
 "id": "WPSEC-2026-2223",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2223/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2223/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2223/index.md",
 "title": "wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Post Content in Topic Moderation Tools",
 "description": "The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post content and titles shown in the topic split and reply move moderation tools in all versions up to, and including, 3.2.2, due to insufficient output escaping. Post excerpts had their tags stripped but were echoed into a label title attribute and the label text without escaping, so quote characters could inject attributes. This makes it possible for authenticated attackers with subscriber-level access and above to inject arbitrary web scripts that execute when a moderator opens these moderation tools for the topic.",
 "plugin": {
  "slug": "wpforo",
  "name": "wpForo Forum",
  "full_name": "wpForo Forum",
  "wordpress_org": "https://wordpress.org/plugins/wpforo/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wpforo/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wpforo"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.2.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.2.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.2.3",
 "remediation": "Update to 3.2.3 or later.",
 "fix_released": "2026-11-01T15:03:11+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:20:19.217988+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2223/",
  "https://plugins.svn.wordpress.org/wpforo/tags/3.2.3/",
  "https://wordpress.org/plugins/wpforo/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wpforo",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}