wpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-93747 · Microsoft / collected KEV context

cve-program · CVE-2026-93747

• https://www.wordfence.com/threat-intel/vulnerabilities/id/15dc1661-793a-43dd-8a12-8f51da6cb304?source=cve
• https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.5/classes/Forms.php#L324
• https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.5/classes/Forms.php#L1074
• https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.5/classes/Members.php#L1157
• https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.5/classes/Members.php#L906
• https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.5/classes/Actions.php#L711
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3706608%40wpforo&new=3706608%40wpforo

No related operational record is retained in the current change model.