The ForumWP – Forum & Discussion Board plugin for WordPress suffers from a reflected cross-site scripting vulnerability (CWE-79) via the 'url' parameter in versions up to 2.1.2. Due to inadequate input sanitization and output escaping, attackers can inject arbitrary web scripts that execute when a user interacts with a maliciously crafted link. This vulnerability does not require authentication and affects the confidentiality and integrity of user interactions but does not impact availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the affected website for users who click on malicious links. This may allow attackers to steal sensitive information such as cookies or session tokens, perform actions on behalf of users, or manipulate web content. There is no impact on system availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted links involving the ForumWP plugin. Monitoring for updates from the plugin vendor is recommended to apply any forthcoming patches promptly.