VendorsgVectorswpforo_forumall versions

Vulnerabilities

gVectors wpForo Forum

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

29CVEs

CVE-2022-40200

WordPress wpForo Forum plugin <= 2.0.9 - Auth. Arbitrary File Upload vulnerability

Published 2022-11-17 · Modified

9.9EPSS 0.010

CVE-2024-3200

wpForo Forum <= 2.3.3 - Authenticated (Contributor+) SQL Injection

Published 2024-06-01 · Modified

9.9EPSS 0.005

CVE-2018-16613

An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress. A registered forum is able to escalate privilege to the forum administrator without any form of user interaction.

Published 2019-06-19 · Modified

9.8EPSS 0.027

CVE-2026-28562

wpForo Forum 2.4.14 SQL Injection via Topics ORDER BY Parameter

Published 2026-02-28 · Analyzed

9.8EPSS 0.005

CVE-2023-47868

WordPress wpForo plugin <= 2.2.3 - Privilege Escalation vulnerability

Published 2024-05-17 · Analyzed

9.8EPSS 0.005

CVE-2023-2249

wpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents

Published 2023-06-09 · Modified

8.8EPSS 0.608

CVE-2022-38144

WordPress wpForo Forum plugin <= 2.0.5 - Cross-Site Request Forgery (CSRF) vulnerability

Published 2022-09-09 · Modified

8.8EPSS 0.005

CVE-2022-40192

WordPress wpForo Forum plugin <= 2.0.9 - Cross-Site Request Forgery (CSRF) vulnerability

Published 2022-11-17 · Modified

8.8EPSS 0.005

CVE-2023-47870

WordPress wpForo Forum Plugin <= 2.2.6 is vulnerable to Broken Access Control and Cross Site Request Forgery (CSRF)

Published 2023-11-30 · Modified

8.8EPSS 0.003

CVE-2024-43288

WordPress wpForo Forum plugin <= 2.3.4 - Insecure Direct Object References (IDOR) vulnerability

Published 2024-08-18 · Analyzed

8.1EPSS 0.003

CVE-2024-43289

WordPress wpForo Forum plugin <= 2.3.4 - Unauthenticated Sensitive Data Exposure vulnerability

Published 2024-08-26 · Analyzed

7.5EPSS 0.004

CVE-2026-28557

wpForo Forum < 2.4.16 Privilege Escalation via Role Synchronization Handler

Published 2026-02-28 · Analyzed

7.1EPSS 0.004

CVE-2026-28559

wpForo Forum 2.4.14 Information Disclosure via Global RSS Feed

Published 2026-02-28 · Analyzed

6.9EPSS 0.005

CVE-2025-0764

wpForo Forum <= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in update

Published 2025-02-28 · Analyzed

6.5EPSS 0.004

CVE-2023-47872

WordPress wpForo Forum Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS)

Published 2023-11-30 · Modified

6.5EPSS 0.004

CVE-2026-28558

wpForo Forum 2.4.14 Stored XSS via SVG Avatar File Upload

Published 2026-02-28 · Analyzed

6.4EPSS 0.003

CVE-2022-40206

WordPress wpForo Forum plugin <= 2.0.5 - Insecure direct object references (IDOR) vulnerability

Published 2022-11-08 · Modified

6.3EPSS 0.005

CVE-2018-11709

wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected Cross-Site Scripting (XSS) via the URI.

Published 2018-06-04 · Modified

6.1EPSS 0.036

CVE-2021-24406

wpForo Forum < 1.9.7 - Open Redirect

Published 2021-07-06 · Modified

6.1EPSS 0.029

CVE-2023-2309

wpForo Forum < 2.1.9 - Reflected Cross-Site Scripting

Published 2023-07-24 · Modified

6.1EPSS 0.008

CVE-2026-28560

wpForo Forum 2.4.14 Stored XSS via Unsafe JSON Encoding in Inline Script