CVE-2026-15021 is a stored cross-site scripting vulnerability in the wpForo Forum WordPress plugin affecting versions up to 3.1.1. The issue is due to improper neutralization of input in the 'location' profile field, where sanitize_text_field() fails to encode double quotes, allowing an attacker with subscriber-level privileges to inject arbitrary JavaScript. This script executes when other users view the injected page, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 base score of 6.4, indicating medium severity. No official patch or remediation guidance is currently available from the vendor, and no known exploits are reported in the wild.

An authenticated attacker with subscriber-level access or higher can inject malicious scripts into the 'location' profile field. These scripts execute in the context of other users viewing the affected pages, potentially leading to information disclosure, session hijacking, or other client-side impacts. The vulnerability does not affect availability but impacts confidentiality and integrity to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user input where possible and consider applying additional input validation or output encoding as a temporary mitigation. Monitor vendor channels for updates and apply patches promptly once released.