CVE-2026-93747 tomdever CVE debrief

Who should care

Defenders responsible for WordPress installations with the wpForo Forum plugin should assess exposure and potential impact, focusing on verifying exposure of vulnerable plugin versions and evaluating the risk of script injection. Security teams, vulnerability management teams, and operators of WordPress platforms with this plugin installed should prioritize this vulnerability.

Why it matters

The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting, allowing authenticated attackers to inject arbitrary web scripts. Defenders should prioritize verifying exposure and assessing impact.

• Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts
• Injected scripts can execute on pages accessed by users
• Defenders must verify exposure of vulnerable wpForo Forum plugin versions
• Remediation priority is high for affected versions

Technical summary

The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'telegram' profile field in versions up to, and including, 3.1.6. This is due to insufficient input sanitization and output escaping in the profile_update action — the raw $_POST['data'] array is copied into a $custom_fields variable before validate() and sanitize() run, both of which operate only on a parallel $user reference, leaving $custom_fields unsanitized when it is persisted via update_custom_fields(); on render, wpforo_decode() reverses the entity encoding and the value is echoed without escaping in field_wrap_profile().

Defensive priority

Defenders should prioritize verifying exposure of the wpForo Forum plugin versions up to 3.1.6 and assess the impact of potential script injection.

Recommended defensive actions

• Verify exposure of wpForo Forum plugin versions up to 3.1.6 in managed environments.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Assign an owner for follow-up on affected product deployments.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. Defenders should verify the exposure of WordPress installations with the wpForo Forum plugin versions up to 3.1.6 and assess the impact of potential script injection. The vulnerability allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts via the 'telegram' profile field. Evidence is limited to public CVE and NVD records; further verification is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.