CVE-2026-80514 debrief based on CVE Program and NVD records. The wpForo Forum WordPress plugin has a medium-severity vulnerability allowing attackers to bypass rate limiting on paid AI requests by spoofing IP address headers. This affects WordPress site owners and administrators, especially those with paid AI requests enabled. They should verify and update the plugin, review site logs, and consider additi [truncated]
The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor who views the profile, including a logged-in administrator. This vulnerability is categorized as a JavaScript inj [truncated]
