Tomdever Wpforo Forum vulnerabilities

• tomdever wpforo forum wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Reply Body in Moderation Forms CVE-2026-120532 6.4 MediumNovember 7, 2026
• tomdever wpforo forum wpForo Forum <= 3.2.1 - Unauthenticated SQL Injection via 'data' Parameter CVE-2026-95870 7.5 HighNovember 7, 2026
• tomdever wpforo forum wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Privilege Escalation to 'data[secondary_groupids]' CSV Parameter CVE-2026-119164 7.5 HighNovember 7, 2026
• tomdever wpforo forum wpForo Forum <= 3.2.2 - Unauthenticated SQL Injection via 'href[locale]' Parameter CVE-2026-119155 7.5 HighNovember 7, 2026
• tomdever wpforo forum wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal via 'theme' Parameter CVE-2026-110004 6.5 MediumNovember 7, 2026
• tomdever wpforo forum wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit Bypass CVE-2026-80514 5.3 MediumSeptember 25, 2026
• tomdever wpforo forum wpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field CVE-2026-93747 6.4 MediumSeptember 25, 2026
• tomdever wpforo forum wpForo Forum < 3.1.6 - Subscriber+ PHP Object Injection via Profile Fields CVE-2026-80513 7.5 HighSeptember 24, 2026
• tomdever wpforo forum WordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability CVE-2026-93772 6.5 MediumSeptember 23, 2026
• tomdever wpforo forum wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie CVE-2026-91092 4.3 MediumSeptember 22, 2026
• tomdever wpforo forum wpForo Forum <= 2.4.17 - Unauthenticated SQL Injection via 'referer' Parameter CVE-2026-5097 7.5 HighAugust 28, 2026
• tomdever wpforo forum wpForo Forum < 3.1.3 - Subscriber+ Account Status and Reputation Manipulation via Profile Update Mass Assignment CVE-2026-12698 4.3 MediumAugust 4, 2026
• tomdever wpforo forum wpForo Forum < 3.1.2 - Subscriber+ Stored XSS via Profile Location Field CVE-2026-12696 5.4 MediumAugust 1, 2026
• tomdever wpforo forum wpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDOR CVE-2026-12697 5.4 MediumJuly 31, 2026
• tomdever wpforo forum wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field CVE-2026-15021 6.4 MediumJuly 16, 2026
• tomdever wpforo forum WordPress wpForo Forum plugin <= 3.0.9 - SQL Injection vulnerability CVE-2026-57636 8.5 HighJune 26, 2026
• tomdever wpforo forum WordPress wpForo Forum plugin <= 3.1.0 - Broken Authentication vulnerability CVE-2026-49767 9.8 CriticalJune 17, 2026
• tomdever wpforo forum WordPress wpForo Forum plugin <= 3.1.0 - PHP Object Injection vulnerability CVE-2026-49769 9.8 CriticalJune 15, 2026
• tomdever wpforo forum WordPress wpForo Forum plugin <= 3.0.4 - SQL Injection vulnerability CVE-2026-40798 9.3 CriticalJune 15, 2026
• tomdever wpforo forum WordPress wpForo Forum plugin < 3.0.2 - Broken Access Control vulnerability CVE-2026-40767 7.5 HighJune 15, 2026
• tomdever wpforo forum WordPress wpForo Forum plugin <= 3.0.6 - Broken Access Control vulnerability CVE-2026-42682 9.1 CriticalJune 1, 2026
• tomdever wpforo forum wpForo Forum <= 3.0.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Custom Profile Field File Path CVE-2026-6248 8.1 HighApril 20, 2026
• tomdever wpforo forum wpForo Forum <= 2.4.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter CVE-2026-4666 6.5 MediumApril 17, 2026
• tomdever wpforo forum wpForo Forum <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter CVE-2026-5809 7.1 HighApril 11, 2026
• tomdever wpforo forum wpForo Forum <= 2.4.16 - Authenticated (Subscriber+) Arbitrary File Deletion via Post Body CVE-2026-3666 8.8 HighApril 4, 2026
• gvectors wpforo forum wpForo Forum 2.4.14 SQL Injection via Topics ORDER BY Parameter CVE-2026-28562 8.8 HighFebruary 28, 2026
• gvectors wpforo forum wpForo Forum 2.4.14 Stored XSS via Unescaped Forum Description in Templates CVE-2026-28561 4.8 MediumFebruary 28, 2026
• gvectors wpforo forum wpForo Forum 2.4.14 Stored XSS via Unsafe JSON Encoding in Inline Script CVE-2026-28560 4.8 MediumFebruary 28, 2026
• gvectors wpforo forum wpForo Forum 2.4.14 Information Disclosure via Global RSS Feed CVE-2026-28559 6.9 MediumFebruary 28, 2026
• gvectors wpforo forum wpForo Forum 2.4.14 Stored XSS via SVG Avatar File Upload CVE-2026-28558 5.1 MediumFebruary 28, 2026
• gvectors wpforo forum wpForo Forum < 2.4.16 Privilege Escalation via Role Synchronization Handler CVE-2026-28557 7.1 HighFebruary 28, 2026
• gvectors wpforo forum wpForo Forum 2.4.14 Missing Authorization via Topic Management Form Handlers CVE-2026-28556 5.3 MediumFebruary 28, 2026
• gvectors wpforo forum wpForo Forum 2.4.14 Missing Authorization via Topic Close AJAX Handler CVE-2026-28555 5.3 MediumFebruary 28, 2026
• gvectors wpforo forum wpForo Forum 2.4.14 Missing Authorization via Post Approval AJAX Handler CVE-2026-28554 5.3 MediumFebruary 28, 2026
• tomdever wpforo forum wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection CVE-2026-1581 Public exploit 7.5 HighFebruary 19, 2026
• tomdever wpforo forum wpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection CVE-2026-0910 8.8 HighFebruary 11, 2026
• tomdever wpforo forum WordPress wpForo Forum plugin <= 2.4.10 - Broken Access Control vulnerability CVE-2025-66070 7.5 HighDecember 18, 2025
• tomdever wpforo forum wpForo Forum <= 2.4.12 - Unauthenticated SQL Injection CVE-2025-13126 7.5 HighDecember 14, 2025
• tomdever wpforo forum wpForo Forum <= 2.4.9 - Authenticated (Susbscriber+) SQL Injection CVE-2025-11740 Public exploit 6.5 MediumNovember 1, 2025
• tomdever wpforo forum wpForo Forum <= 2.4.8 - Unauthenticated SQL Injection via get_members Function CVE-2025-4203 7.5 HighOctober 25, 2025
• tomdever wpforo forum WordPress wpForo Forum Plugin <= 2.4.6 - Insecure Direct Object References (IDOR) Vulnerability CVE-2025-58597 4.3 MediumSeptember 3, 2025
• tomdever wpforo forum wpForo Forum <= 2.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar CVE-2025-4406 5.4 MediumJuly 10, 2025
• tomdever wpforo forum WordPress wpForo Forum plugin <= 2.4.2 - Privilege Escalation vulnerability CVE-2025-31420 7.6 HighApril 4, 2025
• gvectors wpforo forum wpForo Forum <= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in update CVE-2025-0764 6.5 MediumFebruary 28, 2025
• gvectors wpforo forum WordPress wpForo plugin <= 2.2.5 - Broken Access Control + CSRF vulnerability CVE-2023-47869 4.3 MediumDecember 9, 2024
• gvectors wpforo forum WordPress wpForo Forum plugin <= 2.3.4 - Unauthenticated Sensitive Data Exposure vulnerability CVE-2024-43289 7.5 HighAugust 26, 2024
• gvectors wpforo forum WordPress wpForo Forum plugin <= 2.3.4 - Insecure Direct Object References (IDOR) vulnerability CVE-2024-43288 4.3 MediumAugust 18, 2024
• gvectors wpforo forum WordPress wpForo Forum plugin <= 2.0.9 - Auth. HTML Injection vulnerability CVE-2022-38055 4.3 MediumJune 21, 2024
• gvectors wpforo forum wpForo Forum <= 2.3.3 - Authenticated (Contributor+) SQL Injection CVE-2024-3200 9.9 CriticalJune 1, 2024
• gvectors wpforo forum, wpforo forum +1 more WordPress wpForo plugin <= 2.2.3 - Privilege Escalation vulnerability CVE-2023-47868 7.3 HighMay 17, 2024
• Show olderLoading…