Description
wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows authenticated subscribers to upload SVG files as profile avatars through the avatar upload functionality. Attackers upload a crafted SVG containing CSS injection or JavaScript event handlers that execute in the browsers of any user who views the attacker's profile page.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| gVectors Team | wpForo Forum | 2.4 – < 2.4.16 | 2.4.16 |
References
- wpForo Forum WordPress Plugin product
- wpForo Forum Contributors & Developers patch
- VulnCheck Advisory: wpForo Forum 2.4.14 Stored XSS via SVG Avatar File Upload third-party-advisory