CyberRota Analysis
This is a medium severity vulnerability with a CVSS score of 5.5. It affects Java.
CVE
CVE-2026-28560
Severity
MEDIUM
CVSS
5.5
EPSS
0.23%
Java
Original NVD Description
wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inline script block using json_encode without the JSON_HEX_TAG flag. Attackers set a forum slug containing a closing script tag or unescaped single quote to break out of the JavaScript string context and execute arbitrary script in all visitors' browsers.
Related CVEs
Other vulnerabilities affecting the same vendor(s)