Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

wpForo Forum — Vulnerabilities & Security Advisories 50

All 50 CVE vulnerabilities found in wpForo Forum, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security vulnerabilities for wpForo Forum, a third-party PHP plugin for WordPress, focusing primarily on Cross-Site Scripting (XSS) and injection flaws. It collects advisories published from 2014 through 2024, covering both minor and critical severity issues. Here, you can track the vendor's historical release notes, understand the recurring weakness classes affecting this product, and review the complete vulnerability history of wpForo Forum to assess its security posture over time.

Vendor: gVectors Team

CVE ID Title CVSS Severity Published
CVE-2026-0910 wpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection CWE-502 8.8 High 2026-02-11
CVE-2025-66070 WordPress wpForo Forum plugin <= 2.4.10 - Broken Access Control vulnerability CWE-862 7.5 High 2025-12-18
CVE-2025-13126 wpForo Forum <= 2.4.12 - Unauthenticated SQL Injection CWE-89 7.5 High 2025-12-14
CVE-2025-11740 wpForo Forum <= 2.4.9 - Authenticated (Susbscriber+) SQL Injection CWE-89 6.5 Medium 2025-11-01
CVE-2025-4203 wpForo Forum <= 2.4.8 - Unauthenticated SQL Injection via get_members Function CWE-89 7.5 High 2025-10-25
CVE-2025-58597 WordPress wpForo Forum Plugin <= 2.4.6 - Insecure Direct Object References (IDOR) Vulnerability CWE-639 4.3 Medium 2025-09-03
CVE-2025-4406 wpForo Forum <= 2.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar CWE-79 5.4 Medium 2025-07-10
CVE-2025-31420 WordPress wpForo Forum plugin <= 2.4.2 - Privilege Escalation vulnerability CWE-266 7.6 High 2025-04-04
CVE-2025-0764 wpForo Forum <= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in update CWE-20 6.5 Medium 2025-02-28
CVE-2023-47869 WordPress wpForo plugin <= 2.2.5 - Broken Access Control + CSRF vulnerability CWE-80 4.3 Medium 2024-12-09
CVE-2024-43289 WordPress wpForo Forum plugin <= 2.3.4 - Unauthenticated Sensitive Data Exposure vulnerability CWE-200 7.5 High 2024-08-26
CVE-2024-43288 WordPress wpForo Forum plugin <= 2.3.4 - Insecure Direct Object References (IDOR) vulnerability CWE-639 4.3 Medium 2024-08-18
CVE-2022-38055 WordPress wpForo Forum plugin <= 2.0.9 - Auth. HTML Injection vulnerability CWE-80 4.3 Medium 2024-06-21
CVE-2024-3200 wpForo Forum <= 2.3.3 - Authenticated (Contributor+) SQL Injection CWE-89 9.9 Critical 2024-06-01
CVE-2023-47868 WordPress wpForo plugin <= 2.2.3 - Privilege Escalation vulnerability CWE-269 7.3 High 2024-05-17
CVE-2023-47870 WordPress wpForo Forum Plugin <= 2.2.6 is vulnerable to Broken Access Control and Cross Site Request Forgery (CSRF) CWE-352 7.1 Medium 2023-11-30
CVE-2023-47872 WordPress wpForo Forum Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS) CWE-79 6.5 Medium 2023-11-30
CVE-2023-2309 wpForo Forum < 2.1.9 - Reflected Cross-Site Scripting 6.1 - 2023-07-24
CVE-2023-2249 wpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents CWE-98 8.8 High 2023-06-09
CVE-2021-24406 wpForo Forum < 1.9.7 - Open Redirect CWE-601 6.1 - 2021-07-06

All 50 known CVE vulnerabilities affecting wpForo Forum with full Chinese analysis, references, and POCs where available.