CVE-2026-93747 is a stored XSS vulnerability in the wpForo Forum WordPress plugin affecting versions up to 3.1.6. The issue occurs because the raw $_POST['data'] array is copied into a $custom_fields variable before validation and sanitization functions run, which only operate on a parallel $user reference. Consequently, $custom_fields remains unsanitized when persisted via update_custom_fields(). On rendering, wpforo_decode() reverses entity encoding and outputs the value without escaping in field_wrap_profile(), enabling script injection by authenticated users with subscriber-level privileges or higher.

An authenticated attacker with subscriber-level or higher access can inject arbitrary web scripts into the 'telegram' profile field. These scripts execute in the context of any user who views the injected profile page, potentially leading to session hijacking, credential theft, or other malicious actions. The vulnerability has a CVSS 3.1 base score of 6.4 (medium severity), reflecting low complexity of attack, network attack vector, and impact on confidentiality and integrity but no impact on availability.

No official patch or fix is currently documented for this vulnerability. Users should monitor the vendor's advisory for updates. In the meantime, restricting profile field inputs or disabling the 'telegram' profile field may reduce risk. Applying strict input validation and output escaping in custom implementations is recommended. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.