The wpForo Forum WordPress plugin prior to version 3.1.2 contains a CWE-79 Cross-Site Scripting vulnerability. Specifically, it fails to sanitize and escape a user profile field before rendering it inside an HTML attribute on the public participant profile page. This flaw enables users with subscriber-level privileges to inject malicious JavaScript, which executes in the context of any visitor's browser who views the affected profile, potentially including administrators.

Successful exploitation allows an attacker with a subscriber-level account to execute arbitrary JavaScript in the browsers of users who view the compromised profile page. This can lead to session hijacking, privilege escalation, or other malicious actions performed with the privileges of the victim user, including administrators.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 3.1.2, upgrading to version 3.1.2 or later is recommended once confirmed by the vendor. Until a patch is available, restrict subscriber-level account creation and monitor for suspicious activity related to user profiles.