CVE-2026-28558 is a stored cross-site scripting vulnerability in wpForo Forum 2.4.14. Authenticated subscribers can upload SVG files as profile avatars, which may contain malicious CSS or JavaScript event handlers. When other users view the attacker's profile page, the injected code executes in their browsers, potentially leading to unauthorized actions or data exposure. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.1. No patch or vendor advisory details are provided in the available data.

Successful exploitation allows an authenticated subscriber to execute arbitrary code in the browsers of users who view the attacker's profile page via malicious SVG avatars. This can lead to session hijacking, unauthorized actions, or data theft limited to the context of the affected forum users. The impact is confined to users interacting with the malicious profile and does not indicate broader system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict avatar upload permissions to trusted users only or disable SVG avatar uploads if possible. Monitor for suspicious profile avatars and educate users to avoid interacting with untrusted profiles. Avoid recommending generic mitigations not directly related to this vulnerability.