CVE-2026-28558: Wpforo Forum Stored XSS Vulnerability

CVE-2026-28558 Overview

CVE-2026-28558 is a stored cross-site scripting (XSS) vulnerability in the wpForo Forum plugin version 2.4.14 for WordPress. The flaw exists in the avatar upload feature, which accepts Scalable Vector Graphics (SVG) files from authenticated users with the subscriber role. Attackers upload a crafted SVG containing CSS injection or JavaScript event handlers as their profile avatar. The malicious payload executes in the browser of any user who views the attacker's profile page. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact

Authenticated subscribers can store persistent JavaScript on the forum, enabling session theft, forced actions, and phishing against forum visitors and administrators.

Affected Products

• gvectors wpForo Forum 2.4.14
• WordPress sites with the wpForo plugin installed
• Forum deployments allowing subscriber-level registration

Discovery Timeline

• 2026-02-28 - CVE-2026-28558 published to the National Vulnerability Database
• 2026-03-04 - Last updated in NVD database

Technical Details for CVE-2026-28558

Vulnerability Analysis

The wpForo Forum plugin allows registered users to personalize their profile by uploading an avatar image. The avatar upload handler in version 2.4.14 fails to restrict or sanitize SVG files. SVG is an XML-based image format that supports embedded scripts, CSS, and event handlers. When the avatar is rendered as an inline or directly served SVG, browsers execute the embedded content in the origin of the forum.

Any authenticated subscriber can abuse this behavior. The plugin stores the malicious SVG and serves it whenever another user opens the attacker's profile. The payload runs with the session of the viewing user, including moderators and administrators. Successful exploitation requires user interaction in the form of visiting the attacker's profile.

Root Cause

The root cause is missing file type and content validation on the avatar upload endpoint. The plugin treats SVG as a benign image format and does not strip or block active content such as <script> tags, onload attributes, or CSS expression() constructs. Serving the file with an image/svg+xml content type allows browsers to parse the embedded scripting context.

Attack Vector

The attack vector is network-based and requires subscriber-level privileges. The attacker registers an account, navigates to the avatar settings, and uploads a crafted SVG. When a victim browses the attacker's forum profile, the SVG is rendered and the embedded JavaScript executes in the victim's session. Refer to the VulnCheck Advisory on wpForo XSS for technical details on the payload structure and trigger flow.

Detection Methods for CVE-2026-28558

Indicators of Compromise

• Files with .svg extensions stored in the WordPress uploads directory under wpForo avatar paths
• SVG files containing <script>, onload, onerror, or <foreignObject> elements
• Unexpected outbound requests from administrator browsers shortly after viewing forum profiles
• New administrator accounts or modified user roles created without audit log entries

Detection Strategies

• Scan the WordPress uploads directory for SVG files and inspect them for embedded JavaScript or event handler attributes
• Review web server access logs for POST requests to wpForo avatar upload endpoints followed by GET requests retrieving .svg resources
• Monitor browser-side telemetry on administrator workstations for script execution originating from forum profile pages
• Correlate subscriber registration events with subsequent avatar uploads to identify suspicious accounts

Monitoring Recommendations

• Enable WordPress audit logging to capture file uploads, user role changes, and plugin configuration edits
• Alert on creation of SVG files in wpForo asset directories
• Track HTTP responses that serve user-uploaded content with the image/svg+xml MIME type

How to Mitigate CVE-2026-28558

Immediate Actions Required

• Disable the avatar upload feature in wpForo settings until a vendor patch is applied
• Audit the uploads directory and remove any SVG files uploaded by non-administrator accounts
• Restrict new user registration or require manual approval for subscriber accounts
• Force re-authentication for administrators and rotate session tokens after cleanup

Patch Information

At the time of publication, no fixed version has been listed in the NVD entry for CVE-2026-28558. Monitor the WordPress Plugin Page and the WordPress Plugin Developers Section for an updated release that addresses SVG handling in the avatar upload component.

Workarounds

• Configure the web server or a WordPress security plugin to block uploads with the .svg extension or the image/svg+xml MIME type
• Serve user-uploaded content from a separate domain or with a Content-Disposition: attachment header to prevent inline rendering
• Apply a strict Content Security Policy (CSP) that disallows inline scripts on forum pages
• Use a web application firewall (WAF) rule to inspect uploaded SVG bodies for <script> or event handler patterns

# Example nginx configuration to force SVG downloads instead of inline rendering
location ~* /wp-content/uploads/.*\.svg$ {
    add_header Content-Disposition "attachment";
    add_header X-Content-Type-Options "nosniff";
    types { application/octet-stream svg; }
}