The ForumWP – Forum & Discussion Board plugin for WordPress suffers from a reflected cross-site scripting vulnerability due to improper neutralization of input during web page generation. Specifically, the plugin uses add_query_arg and remove_query_arg functions without appropriate escaping on URL parameters in all versions up to and including 2.1.2. This flaw allows unauthenticated attackers to inject arbitrary web scripts that execute when a user interacts with a maliciously crafted link. The vulnerability is tracked as CVE-2024-10879 with a CVSS 3.1 base score of 6.1 (medium severity).

Successful exploitation can lead to the execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of user credentials, session tokens, or other sensitive information accessible to the browser. The vulnerability requires user interaction (clicking a malicious link) and does not grant direct system access or denial of service. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links received from untrusted sources and consider disabling or limiting the use of the ForumWP plugin if possible. Monitor the vendor's communications for updates on patches or official mitigations.