The wpForo Forum WordPress plugin versions prior to 3.1.2 contain a stored cross-site scripting vulnerability (CWE-79) due to improper sanitization and escaping of a user profile field. This vulnerability allows a subscriber-level user to inject malicious JavaScript code into their profile, which is then executed in the browsers of any visitors viewing that profile page. The vulnerability affects the public participant profile page and can lead to cross-site scripting attacks that compromise confidentiality and integrity but do not affect availability.

Successful exploitation allows an attacker with a subscriber-level account to execute arbitrary JavaScript in the context of any visitor viewing the affected profile page, including administrators. This can lead to information disclosure and integrity issues such as session hijacking or unauthorized actions performed by the administrator. The CVSS score of 5.4 reflects a medium severity impact with network attack vector, low attack complexity, requiring low privileges and user interaction, and partial confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 3.1.2, upgrading to version 3.1.2 or later is likely recommended once confirmed by the vendor. Until then, restrict subscriber-level user capabilities or monitor for suspicious profile content as a temporary measure.