Unauthenticated Cross Site Scripting (XSS) in WP w3all phpBB <= 3.0.6 versions. (CVE-2026-78293)

CVE-2026-78293 describes an unauthenticated Cross Site Scripting (XSS) vulnerability affecting WP w3all phpBB versions <= 3.0.6. The vulnerability allows remote attackers with no privileges to inject malicious scripts, potentially impacting confidentiality, integrity, and availability to a limited extent. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed, with low impact on confidentiality and integrity and low impact on availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of other users, potentially leading to session hijacking, defacement, or other client-side attacks. The impact is rated high due to the unauthenticated nature and the scope change, but the confidentiality, integrity, and availability impacts are low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, users should consider applying workarounds or mitigations recommended by the vendor if any are published.