CVE-2026-28558

wpForo Forum 2.4.14 Stored XSS via SVG Avatar File Upload

State: Published
Severity: 5.1 Medium
Published: Feb 28, 2026
Updated: May 11, 2026
Reserved: Feb 28, 2026

Description

wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows authenticated subscribers to upload SVG files as profile avatars through the avatar upload functionality. Attackers upload a crafted SVG containing CSS injection or JavaScript event handlers that execute in the browsers of any user who views the attacker's profile page.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N	VulnCheck
3.1	6.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	VulnCheck

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
wpForo ForumgVectors Team	2.4 to before 2.4.16Affected 2.4.16Not affected

References

wpForo Forum WordPress Pluginproduct
wpForo Forum Contributors & Developerspatch
VulnCheck Advisory: wpForo Forum 2.4.14 Stored XSS via SVG Avatar File Uploadthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.