THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-12696 — The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser

[NVD] CVE-2026-12696 — The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser

mednvdPublished 2026-08-01

CVE-2026-12696 CVSS: None Published: 2026-08-01T07:16:28.797

The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor who views the profile, including a logged-

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2026-12696cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-12696