axew3 vulnerabilities and threats

CVE-2026-107422 is a stored cross-site scripting (XSS) vulnerability in the WP w3all phpBB integration plugin for WordPress. It affects versions from initial release up to 3.1.1. The vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers with low privileges to inject malicious scripts that execute in the context of other users. The CVSS 3.1 base score is 6.5, indicating a medium severity level.

CVE-2026-78293 is a high severity vulnerability in WP w3all phpBB versions up to and including 3.0.6 that allows unauthenticated attackers to perform cross-site scripting (XSS) attacks. This vulnerability arises from improper neutralization of input during web page generation, enabling attackers to inject malicious scripts. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

CVE-2026-73998 is a high-severity SQL Injection vulnerability affecting WP w3all phpBB versions up to 3.0.5. It involves improper neutralization of special elements in SQL commands, allowing an attacker with low privileges to execute crafted SQL queries. The vulnerability impacts confidentiality and availability but does not affect integrity. No patch or remediation details are provided in the available data.

Cross-Site Request Forgery (CSRF) vulnerability in axew3 WP w3all phpBB wp-w3all-phpbb-integration allows Reflected XSS.This issue affects WP w3all phpBB: from n/a through <= 2.9.9.

Cross-Site Request Forgery (CSRF) vulnerability in axew3 WP w3all phpBB wp-w3all-phpbb-integration allows Cross Site Request Forgery.This issue affects WP w3all phpBB: from n/a through <= 2.9.8.