CVE-2026-28560 is a stored cross-site scripting vulnerability in wpForo Forum 2.4.14 caused by improper input neutralization when forum URL data is embedded into inline JavaScript using json_encode without the JSON_HEX_TAG flag. This allows attackers to inject malicious scripts by manipulating the forum slug to include characters that break out of the JavaScript string context, such as closing script tags or unescaped single quotes, resulting in arbitrary script execution in visitors' browsers. The vulnerability has a CVSS 4.0 score of 4.8 (medium severity). No patch or vendor advisory is currently available, and no known exploitation has been reported.

Successful exploitation allows an attacker with high privileges to inject arbitrary JavaScript code that executes in the browsers of all visitors to the affected forum pages. This can lead to session hijacking, defacement, or other client-side attacks. However, the vulnerability requires high privileges to set the malicious forum slug and user interaction to trigger the script execution. No evidence of active exploitation is currently known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege users from creating or modifying forum slugs with untrusted input. Consider applying input validation or output encoding workarounds to prevent injection of script-breaking characters in forum slugs. Monitor vendor channels for updates and patches addressing this vulnerability.