tomdever
- Total products in the ecosystem
- 1
- Total vulnerabilities (90 days)
- 9
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, tomdever recorded 9 security vulnerabilities in the last 90 days across 1 products, including 4 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, wpForo Forum had the most security vulnerabilities in the tomdever ecosystem, with 9 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-95870wpForo Forum <= 3.2.1 - Unauthenticated SQL Injection via 'data' ParameterCVE-2026-120532wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Reply Body in Moderation FormsCVE-2026-119164wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Privilege Escalation to 'data[secondary_groupids]' CSV ParameterCVE-2026-119155wpForo Forum <= 3.2.2 - Unauthenticated SQL Injection via 'href[locale]' ParameterCVE-2026-110004wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal via 'theme' Parameter| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-95870wpForo Forum <= 3.2.1 - Unauthenticated SQL Injection via 'data' Parameter | Exploitation statusNot exploited | FixYes |
| Published11/07/2026 |
| SeverityHigh |
CVE-2026-120532wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Reply Body in Moderation Forms | Exploitation statusNot exploited | FixYes | Affected productwpForo Forum | Published11/07/2026 | SeverityMedium |
|---|
CVE-2026-119164wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Privilege Escalation to 'data[secondary_groupids]' CSV Parameter | Exploitation statusNot exploited | FixYes | Affected productwpForo Forum | Published11/07/2026 | SeverityHigh |
|---|
CVE-2026-119155wpForo Forum <= 3.2.2 - Unauthenticated SQL Injection via 'href[locale]' Parameter | Exploitation statusNot exploited | FixYes | Affected productwpForo Forum | Published11/07/2026 | SeverityHigh |
|---|
CVE-2026-110004wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal via 'theme' Parameter | Exploitation statusNot exploited | FixYes | Affected productwpForo Forum | Published11/07/2026 | SeverityMedium |
|---|
CVE-2026-93747wpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field | Exploitation statusNot exploited | FixYes | Affected productwpForo Forum | Published09/25/2026 | SeverityMedium |
|---|
CVE-2026-93772WordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productwpForo Forum | Published09/23/2026 | SeverityMedium |
|---|
CVE-2026-91092wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie | Exploitation statusNot exploited | FixYes | Affected productwpForo Forum | Published09/22/2026 | SeverityMedium |
|---|
CVE-2026-5097wpForo Forum <= 2.4.17 - Unauthenticated SQL Injection via 'referer' Parameter | Exploitation statusNot exploited | FixYes | Affected productwpForo Forum | Published08/28/2026 | SeverityHigh |
|---|
CVE-2026-15021wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field | Exploitation statusNot exploited | FixYes | Affected productwpForo Forum | Published07/16/2026 | SeverityMedium |
|---|
CVE-2026-57636WordPress wpForo Forum plugin <= 3.0.9 - SQL Injection vulnerability | Exploitation statusNot exploited | FixYes | Affected productwpForo Forum | Published06/26/2026 | SeverityHigh |
|---|
CVE-2026-49767WordPress wpForo Forum plugin <= 3.1.0 - Broken Authentication vulnerability | Exploitation statusNot exploited | FixYes | Affected productwpForo Forum | Published06/17/2026 | SeverityCritical |
|---|
CVE-2026-49769WordPress wpForo Forum plugin <= 3.1.0 - PHP Object Injection vulnerability | Exploitation statusNot exploited | FixYes | Affected productwpForo Forum | Published06/15/2026 | SeverityCritical |
|---|
CVE-2026-40798WordPress wpForo Forum plugin <= 3.0.4 - SQL Injection vulnerability | Exploitation statusNot exploited | FixYes | Affected productwpForo Forum | Published06/15/2026 | SeverityCritical |
|---|
CVE-2026-40767WordPress wpForo Forum plugin < 3.0.2 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productwpForo Forum | Published06/15/2026 | SeverityHigh |
|---|
CVE-2026-42682WordPress wpForo Forum plugin <= 3.0.6 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productwpForo Forum | Published06/01/2026 | SeverityCritical |
|---|
CVE-2026-6248wpForo Forum <= 3.0.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Custom Profile Field File Path | Exploitation statusNot exploited | FixYes | Affected productwpForo Forum | Published04/20/2026 | SeverityHigh |
|---|
CVE-2026-4666wpForo Forum <= 2.4.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter | Exploitation statusNot exploited | FixYes | Affected productwpForo Forum | Published04/17/2026 | SeverityMedium |
|---|
CVE-2026-5809wpForo Forum <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter | Exploitation statusNot exploited | FixYes | Affected productwpForo Forum | Published04/11/2026 | SeverityHigh |
|---|
CVE-2026-3666wpForo Forum <= 2.4.16 - Authenticated (Subscriber+) Arbitrary File Deletion via Post Body | Exploitation statusNot exploited | FixYes | Affected productwpForo Forum | Published04/04/2026 | SeverityHigh |
|---|
CVE-2026-1581wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection | Exploitation statusNot exploited | FixYes | Affected productwpForo Forum | Published02/19/2026 | SeverityHigh |
|---|
CVE-2026-0910wpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection | Exploitation statusNot exploited | FixYes | Affected productwpForo Forum | Published02/11/2026 | SeverityHigh |
|---|
CVE-2025-66070WordPress wpForo Forum plugin <= 2.4.10 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productwpForo Forum | Published12/18/2025 | SeverityHigh |
|---|
CVE-2025-13126wpForo Forum <= 2.4.12 - Unauthenticated SQL Injection | Exploitation statusNot exploited | FixYes | Affected productwpForo Forum | Published12/14/2025 | SeverityHigh |
|---|
CVE-2025-11740wpForo Forum <= 2.4.9 - Authenticated (Susbscriber+) SQL Injection | Exploitation statusNot exploited | FixYes | Affected productwpForo Forum | Published11/01/2025 | SeverityMedium |
|---|
CVE-2025-4203wpForo Forum <= 2.4.8 - Unauthenticated SQL Injection via get_members Function | Exploitation statusNot exploited | FixYes | Affected productwpForo Forum | Published10/25/2025 | SeverityHigh |
|---|
CVE-2025-58597WordPress wpForo Forum Plugin <= 2.4.6 - Insecure Direct Object References (IDOR) Vulnerability | Exploitation statusNot exploited | FixYes | Affected productwpForo Forum | Published09/03/2025 | SeverityMedium |
|---|
CVE-2025-4406wpForo Forum <= 2.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar | Exploitation statusNot exploited | FixYes | Affected productwpForo Forum | Published07/10/2025 | SeverityMedium |
|---|
CVE-2025-31420WordPress wpForo Forum plugin <= 2.4.2 - Privilege Escalation vulnerability | Exploitation statusNot exploited | FixYes | Affected productwpForo Forum | Published04/04/2025 | SeverityHigh |
|---|
CVE-2025-0764wpForo Forum <= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in update | Exploitation statusNot exploited | FixYes | Affected productwpForo Forum | Published02/28/2025 | SeverityMedium |
|---|
CVE-2024-3200wpForo Forum <= 2.3.3 - Authenticated (Contributor+) SQL Injection | Exploitation statusNot exploited | FixYes | Affected productwpForo Forum | Published06/01/2024 | SeverityCritical |
|---|
CVE-2023-2249wpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents | Exploitation statusNot exploited | FixYes | Affected productwpForo Forum | Published06/09/2023 | SeverityHigh |
|---|
32 Results | Page 1 of 1