CVE-2018-25384

MEDIUM

Wikidforum 2.20 Cross-Site Scripting via reply_text Parameter

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-25384. PoCs published by Amir Hossein Mahboubi.

AI-analyzed exploit summary This exploit demonstrates a stored XSS vulnerability in Wikidforum 2.20 via the 'reply_text' parameter in an RPC POST request. The payload injects malicious JavaScript via an 'onerror' event in an img tag.

Description

Wikidforum 2.20 contains a cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted HTML in the reply_text parameter. Attackers can post comments containing JavaScript code through the rpc.php endpoint that executes in other users' browsers when viewing forum replies.

Exploits (1)

exploitdb WORKING POC
by Amir Hossein Mahboubi · textwebappsphp
https://www.exploit-db.com/exploits/45580

This exploit demonstrates a stored XSS vulnerability in Wikidforum 2.20 via the 'reply_text' parameter in an RPC POST request. The payload injects malicious JavaScript via an 'onerror' event in an img tag.

Classification
Working Poc 95%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Wikidforum <= 2.20
Auth required
Prerequisites: Authenticated user session · Valid post/comment context
devstral-2 · analyzed May 29, 2026 Full analysis →

References (4)

Core 4
Core References
Exploit exploit
ExploitDB-45580
https://www.exploit-db.com/exploits/45580
Product product
Official Product Homepage
https://sourceforge.net/projects/wikidforum/
Third Party Advisory third-party-advisory
VulnCheck Advisory: Wikidforum 2.20 Cross-Site Scripting via reply_text Parameter
https://www.vulncheck.com/advisories/wikidforum-cross-site-scripting-via-reply-text-parameter

Scores

CVSS v3 5.4
EPSS 0.0022
EPSS Percentile 11.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
wikidforum/Wikidforum < 2.2.0
wikidforum/Wikidforum < 2.20
Published May 29, 2026
Tracked Since May 29, 2026