https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-23T06:04:17.614488+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-28560 CVE-2026-28560 — wpForo Forum 2.4.14 Stored XSS via Unsafe JSON Encoding in Inline Script 2026-10-23T06:04:17.630615+00:00

Affected: gVectors Team wpForo Forum

wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inline script block using json_encode without the JSON_HEX_TAG flag. Attackers set a forum slug containing a closing script tag or unescaped single quote to break out of the JavaScript string context and execute arbitrary script in all visitors' browsers.