Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

wpForo Forum — Vulnerabilities & Security Advisories 50

All 50 CVE vulnerabilities found in wpForo Forum, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security vulnerabilities for wpForo Forum, a third-party PHP plugin for WordPress, focusing primarily on Cross-Site Scripting (XSS) and injection flaws. It collects advisories published from 2014 through 2024, covering both minor and critical severity issues. Here, you can track the vendor's historical release notes, understand the recurring weakness classes affecting this product, and review the complete vulnerability history of wpForo Forum to assess its security posture over time.

Vendor: gVectors Team

CVE ID Title CVSS Severity Published
CVE-2026-80514 wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit Bypass 5.3 Medium 2026-09-25
CVE-2026-93747 wpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field CWE-79 6.4 Medium 2026-09-25
CVE-2026-80513 wpForo Forum < 3.1.6 - Subscriber+ PHP Object Injection via Profile Fields - - 2026-09-24
CVE-2026-93772 WordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability CWE-79 6.5 Medium 2026-09-23
CVE-2026-91092 wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie CWE-862 4.3 Medium 2026-09-22
CVE-2026-5097 wpForo Forum <= 2.4.17 - Unauthenticated SQL Injection via 'referer' Parameter CWE-89 7.5 High 2026-08-28
CVE-2026-12698 wpForo Forum < 3.1.3 - Subscriber+ Account Status and Reputation Manipulation via Profile Update Mass Assignment - - 2026-08-04
CVE-2026-12696 wpForo Forum < 3.1.2 - Subscriber+ Stored XSS via Profile Location Field - - 2026-08-01
CVE-2026-12697 wpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDOR - - 2026-07-31
CVE-2026-15021 wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field CWE-79 6.4 Medium 2026-07-16
CVE-2026-57636 WordPress wpForo Forum plugin <= 3.0.9 - SQL Injection vulnerability CWE-89 8.5 High 2026-06-26
CVE-2026-49767 WordPress wpForo Forum plugin <= 3.1.0 - Broken Authentication vulnerability CWE-288 9.8 Critical 2026-06-17
CVE-2026-49769 WordPress wpForo Forum plugin <= 3.1.0 - PHP Object Injection vulnerability CWE-502 9.8 Critical 2026-06-15
CVE-2026-40798 WordPress wpForo Forum plugin <= 3.0.4 - SQL Injection vulnerability CWE-89 9.3 Critical 2026-06-15
CVE-2026-40767 WordPress wpForo Forum plugin < 3.0.2 - Broken Access Control vulnerability CWE-281 7.5 High 2026-06-15
CVE-2026-42682 WordPress wpForo Forum plugin <= 3.0.6 - Broken Access Control vulnerability CWE-862 9.1 Critical 2026-06-01
CVE-2026-6248 wpForo Forum <= 3.0.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Custom Profile Field File Path CWE-22 8.1 High 2026-04-20
CVE-2026-4666 wpForo Forum <= 2.4.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter CWE-862 6.5 Medium 2026-04-17
CVE-2026-5809 wpForo Forum <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter CWE-73 7.1 High 2026-04-11
CVE-2026-3666 wpForo Forum <= 2.4.16 - Authenticated (Subscriber+) Arbitrary File Deletion via Post Body CWE-22 8.8 High 2026-04-04
CVE-2026-28562 wpForo Forum 2.4.14 SQL Injection via Topics ORDER BY Parameter CWE-89 8.2 High 2026-02-28
CVE-2026-28561 wpForo Forum 2.4.14 Stored XSS via Unescaped Forum Description in Templates CWE-79 5.5 Medium 2026-02-28
CVE-2026-28560 wpForo Forum 2.4.14 Stored XSS via Unsafe JSON Encoding in Inline Script CWE-79 5.5 Medium 2026-02-28
CVE-2026-28559 wpForo Forum 2.4.14 Information Disclosure via Global RSS Feed CWE-200 5.3 Medium 2026-02-28
CVE-2026-28558 wpForo Forum 2.4.14 Stored XSS via SVG Avatar File Upload CWE-79 6.4 Medium 2026-02-28
CVE-2026-28557 wpForo Forum < 2.4.16 Privilege Escalation via Role Synchronization Handler CWE-862 6.5 Medium 2026-02-28
CVE-2026-28555 wpForo Forum 2.4.14 Missing Authorization via Topic Close AJAX Handler CWE-862 4.3 Medium 2026-02-28
CVE-2026-28556 wpForo Forum 2.4.14 Missing Authorization via Topic Management Form Handlers CWE-862 5.4 Medium 2026-02-28
CVE-2026-28554 wpForo Forum 2.4.14 Missing Authorization via Post Approval AJAX Handler CWE-862 4.3 Medium 2026-02-28
CVE-2026-1581 wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection CWE-89 7.5 High 2026-02-19

All 50 known CVE vulnerabilities affecting wpForo Forum with full Chinese analysis, references, and POCs where available.