CVE-2025-4224

CVE-2025-4224 (wpForo + wpForo Advanced Attachments) affects the WordPress plugin pair and enables Stored Cross-Site Scripting via media upload names due to insufficient input sanitization and output escaping. According to the provided documents, exploitation requires Custom-level access or highe...

CVE-2025-4224 wpForo + wpForo Advanced Attachments <= 3.1.3 - Unauthenticated Stored Cross-Site Scripting

The wpForo + wpForo Advanced Attachments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via media upload names in all versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...