Inside CVE-2026-93747: Stored XSS in Member Profile Fields
The storage step is an authenticated POST to the forum account page (wpfaction=profile_update). The form is nonce-verified and ownership is enforced, so the attacker needs only an ordinary member account — no administrator role. Forms::validate() applies no HTML encoding to text fields; it length-checks the value and even runs htmlspecialchars_decode(), so markup reaches the database untouched. On render, Forms::prepare_values() encodes only a short whitelist of field types and names. Everything else — including built-in text fields such as 'occupation' — is concatenated raw by field_wrap_profile(), and wpforo_apply_ucf_shortcode() returns stored values unescaped when filling [wpfucf] placeholders in HTML profile templates. Any visitor permitted to view the field executes the stored script in their own session, and administrators reviewing profiles are the highest-value targets.
BitFire FREE WAF Blocks the Payload Before It Is Stored
A stored XSS has exactly one delivery moment: the profile-update request. That POST body is exactly where BitFire intercepts it. The BitFire FREE Web Application Firewall inspects form fields and POST bodies before WordPress processes them and detects malicious JavaScript payloads in submitted data. When a profile update carries script content, BitFire blocks the request: the value never reaches the database, and no profile page ever renders it to an administrator. The one dependency — a matching script payload in inspected request data — is exactly what this exploit must transmit to function. Because the rules are behavior-based, they stop unknown CVEs without a CVE-specific virtual patch. The protection ships in BitFire FREE for eligible non-commercial websites; commercial sites need a commercial license.
If Your Site Was Affected, Investigate for Persistence
Updating to 3.1.7 closes the rendering hole, but it does not undo what an exploited session already did. Script that ran in an administrator's browser acted with that administrator's authority — new admin accounts, uploaded files, changed settings. If wpForo 3.1.6 or earlier was ever live on your site, run BitFire PRO Threat Hunter immediately. It performs a thorough post-compromise investigation and surfaces backdoor WordPress administrator accounts, hidden database triggers, long-running PHP processes, and droppers that can reinstall malware or reinfect a site that looks clean. Patch, investigate, remove every persistence mechanism it finds, and rotate administrator credentials. An absence of obvious malicious files is not proof your site is clean.
Patch Now, Then Let BitFire Hold the Line
Update wpForo to 3.1.7 today — the release also fixes an infinite recursion that caused fatal errors and 504 timeouts on forum pages. Then put BitFire in front of the site: the FREE WAF blocks cross-site scripting payloads in profile updates before they are stored, protection that holds even on the day a new bug ships. Already ran an affected version? Let BitFire PRO Threat Hunter sweep for backdoor admins, hidden triggers, and droppers. Get BitFire FREE now.
