Version 3.1.0 – XSS vulnerability – Support

#1 · July 31, 2025, 1:18 pm

We’re currently receiving XSS vulnerability alerts related to the current version of Asgaros Forums. Do you have an estimated timeline for when an update addressing this issue might be released? We have the plugin installed on multiple sites, so resolving this is critical for us. We’d really appreciate any updates you can provide. Thank you!

Patch stack alert

Thanks,
Matt

#2 · August 9, 2025, 6:08 am

Hi @m-brookingmixd-co-uk

I am aware of this report since weeks/months and usually I try to fix those issues within hours. However, for this particular one I never got any details from the vulnerability-reporter so I have absolutely no clue in which module or section this vulnerability should be existent. I tried already to investigate, but without disclosure to me, this report is as useful as if someone tells you, that you have a problem in your house. It could be everything or nothing. That is the sad truth.

As soon as I get steps to reproduce this issue from somewhere, I will fix it immediately.

Edit: I made this topic a global sticky because I get similar requests continuously. Maybe it also helps to get more information.

SheWhoBuilds and GBFM have reacted to this post.

If you want to support the development of Asgaros Forum, you can leave a good review or donate. Thank you very much!

#3 · August 11, 2025, 1:10 pm

Hi @asgaros

Thanks for the update. I understand this is a tricky issue to fix, and I appreciate the effort you’re putting into it.

Please let us know as soon as you’ve rolled out a fix so we can distribute it across all our websites using the plugin.

Thanks,
Matt

#4 · August 16, 2025, 10:30 pm

Hi @asgaros

I’ve had this if this helps at all?

https://www.wordfence.com/threat-intel/vulnerabilities/id/df324557-9ead-46aa-a019-89d1d5ca6d9c?source=plugin

Thanks,

Andy

#5 · August 26, 2025, 12:04 pm

Hi @asgaros

In the link the user above posted states the vulnerability is “due to insufficient input sanitization and output escaping”. Are you able to check all the inputs in the plugin to ensure they are being sanitized sufficiently?

Thanks,
Matt

#6 · September 15, 2025, 2:18 pm

Hi @asgaros

Just want to find out if we’re any closer to this issue being resolved?

Another user has submitted a pull request to the plugin over on the WordPress support forums:
https://wordpress.org/support/topic/version-3-1-0-xss-vulnerability/#post-18631788
https://github.com/Asgaros/asgaros-forum/pull/402

I wondered if you have had any time to review this at all?

Thanks,
Matt