CVE-2025-4224 is a stored cross-site scripting vulnerability in the wpForo + wpForo Advanced Attachments WordPress plugin (versions up to 3.1.3). The issue stems from improper neutralization of input during web page generation, specifically insufficient sanitization and output escaping of media upload file names. Authenticated users with Custom-level access or higher can upload media with crafted names containing malicious scripts. These scripts are stored and later executed in the context of any user viewing the injected page, potentially compromising user sessions or data. The vulnerability has a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), indicating network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, and low confidentiality and integrity impacts.

An attacker with authenticated Custom-level access or higher can inject malicious scripts via media upload names that execute in the context of users viewing the affected pages. This can lead to unauthorized disclosure of information and modification of data within the affected application context. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor for updates from gVectors and consider restricting upload permissions to trusted users only. Applying standard WordPress security best practices for plugin updates and user access control is advisable until an official fix is released.