CVE-2025-13746

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13746", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-26T15:00:43.150Z", "datePublished": "2026-01-06T03:21:41.135Z", "dateUpdated": "2026-04-08T17:32:20.326Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:32:20.326Z"}, "affected": [{"vendor": "ultimatemember", "product": "ForumWP \u2013 Forum & Discussion Board", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.1.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The ForumWP \u2013 Forum & Discussion Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User's Display Name in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "ForumWP \u2013 Forum & Discussion Board <= 2.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f0eb6dc5-98e2-4d88-98f8-8a63c939b047?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/forumwp/tags/2.1.5/assets/front/js/tooltip.js#L25"}, {"url": "https://plugins.trac.wordpress.org/browser/forumwp/tags/2.1.5/includes/common/class-user.php#L906"}, {"url": "https://plugins.trac.wordpress.org/browser/forumwp/tags/2.1.5/templates/user-card.php#L57"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Sergej Ljubojevic"}], "timeline": [{"time": "2025-11-17T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-12-04T08:28:04.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-05T14:45:41.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-06T14:56:16.044323Z", "id": "CVE-2025-13746", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-06T14:58:24.419Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13746", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-06T14:56:16.044323Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-06T14:56:41.636Z"}}], "cna": {"title": "ForumWP \u2013 Forum & Discussion Board <= 2.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name", "credits": [{"lang": "en", "type": "finder", "value": "Sergej Ljubojevic"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "ultimatemember", "product": "ForumWP \u2013 Forum & Discussion Board", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.1.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-17T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-12-04T08:28:04.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-05T14:45:41.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f0eb6dc5-98e2-4d88-98f8-8a63c939b047?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/forumwp/tags/2.1.5/assets/front/js/tooltip.js#L25"}, {"url": "https://plugins.trac.wordpress.org/browser/forumwp/tags/2.1.5/includes/common/class-user.php#L906"}, {"url": "https://plugins.trac.wordpress.org/browser/forumwp/tags/2.1.5/templates/user-card.php#L57"}], "descriptions": [{"lang": "en", "value": "The ForumWP \u2013 Forum & Discussion Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User's Display Name in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:32:20.326Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13746", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:32:20.326Z", "dateReserved": "2025-11-26T15:00:43.150Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-06T03:21:41.135Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ForumWP \u2013 Forum & Discussion Board", "vendor": "ultimatemember", "versions": [{"lessThanOrEqual": "2.1.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The ForumWP \u2013 Forum & Discussion Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User's Display Name in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin ForumWP \u2013 Forum &amp; Discussion Board para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del Nombre de Visualizaci\u00f3n del Usuario en todas las versiones hasta la 2.1.6, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto hace posible que atacantes autenticados, con acceso de nivel Suscriptor y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-13746", "lastModified": "2026-06-17T08:34:41.097", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13746", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-06T14:56:16.044323Z", "version": "2.0.3"}}]}, "published": "2026-01-06T04:15:52.900", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/forumwp/tags/2.1.5/assets/front/js/tooltip.js#L25"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/forumwp/tags/2.1.5/includes/common/class-user.php#L906"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/forumwp/tags/2.1.5/templates/user-card.php#L57"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f0eb6dc5-98e2-4d88-98f8-8a63c939b047?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T00:36:11.109200+00:00", "value": {"mitigation_remediation": ["Install ForumWP version 2.1.7 or later, which removes the flaw by validating and escaping display names before storage.", "If an immediate upgrade is not feasible, inspect existing display names for embedded HTML or script tags and replace or sanitize them manually, ensuring only plain text is stored.", "Restrict Subscriber+ users from editing their display name through configuration or custom code, thereby preventing injection from authenticated users while awaiting a full patch."], "summary": {"action": "Apply Patch", "impact": "Stored cross\u2011site scripting (Subscriber+ authentication required)"}, "threat_synthesis": {"affected_systems": "All installations using ForumWP version 2.1.6 or earlier, including the 2.1.5 tags cited in the advisory, are affected. The plugin is distributed by UltimateMember and deployed on WordPress sites that have enabled user profiles or discussion boards.", "description_and_impact": "The ForumWP \u2013 Forum & Discussion Board plugin for WordPress contains a stored cross\u2011site scripting flaw caused by insufficient sanitization of the user\u2019s display name field. An attacker who can log in as a Subscriber or higher can inject arbitrary JavaScript into the display name. When a victim views a page that renders the injected name, the scripts execute in the victim\u2019s browser, enabling data theft, session hijacking, or other client\u2011side attacks.", "risk_and_exploitability": "The vulnerability is scored CVSS 6.4, indicating a moderate risk. Its EPSS score is below 1\u202f%, suggesting that exploitation is unlikely but not impossible. The flaw is not listed in CISA\u2019s KEV catalog, indicating no known widespread exploitation yet. An attacker must be authenticated as a user with at least Subscriber privileges; the typical attack path involves editing the display name either through the user profile page or the forum member area, after which injected scripts run when other users view the profile or forum post. The limited authentication requirement reduces the attack surface, yet once compromised accounts can be used to spread malicious payloads to other site visitors."}}}}, "created": "2026-01-06T14:15:52.796993+00:00", "updated": "2026-04-21T00:45:23.091528+00:00", "vendors": ["ultimatemember", "ultimatemember$PRODUCT$forumwp", "wordpress", "wordpress$PRODUCT$wordpress"]}