- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/07/2026, wpForo Forum recorded 9 security vulnerabilities in the last 90 days, of which 4 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of wpForo Forum and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-95870wpForo Forum <= 3.2.1 - Unauthenticated SQL Injection via 'data' ParameterCVE-2026-120532wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Reply Body in Moderation FormsCVE-2026-119164wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Privilege Escalation to 'data[secondary_groupids]' CSV ParameterCVE-2026-119155wpForo Forum <= 3.2.2 - Unauthenticated SQL Injection via 'href[locale]' ParameterCVE-2026-110004wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal via 'theme' Parameter| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-95870wpForo Forum <= 3.2.1 - Unauthenticated SQL Injection via 'data' Parameter | Exploitation statusNot exploited | FixYes |
| SeverityHigh |
CVE-2026-120532wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Reply Body in Moderation Forms | Exploitation statusNot exploited | FixYes | Published11/07/2026 | SeverityMedium |
|---|
CVE-2026-119164wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Privilege Escalation to 'data[secondary_groupids]' CSV Parameter | Exploitation statusNot exploited | FixYes | Published11/07/2026 | SeverityHigh |
|---|
CVE-2026-119155wpForo Forum <= 3.2.2 - Unauthenticated SQL Injection via 'href[locale]' Parameter | Exploitation statusNot exploited | FixYes | Published11/07/2026 | SeverityHigh |
|---|
CVE-2026-110004wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal via 'theme' Parameter | Exploitation statusNot exploited | FixYes | Published11/07/2026 | SeverityMedium |
|---|
CVE-2026-93747wpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field | Exploitation statusNot exploited | FixYes | Published09/25/2026 | SeverityMedium |
|---|
CVE-2026-93772WordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Published09/23/2026 | SeverityMedium |
|---|
CVE-2026-91092wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie | Exploitation statusNot exploited | FixYes | Published09/22/2026 | SeverityMedium |
|---|
CVE-2026-5097wpForo Forum <= 2.4.17 - Unauthenticated SQL Injection via 'referer' Parameter | Exploitation statusNot exploited | FixYes | Published08/28/2026 | SeverityHigh |
|---|
CVE-2026-15021wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field | Exploitation statusNot exploited | FixYes | Published07/16/2026 | SeverityMedium |
|---|
CVE-2026-57636WordPress wpForo Forum plugin <= 3.0.9 - SQL Injection vulnerability | Exploitation statusNot exploited | FixYes | Published06/26/2026 | SeverityHigh |
|---|
CVE-2026-49767WordPress wpForo Forum plugin <= 3.1.0 - Broken Authentication vulnerability | Exploitation statusNot exploited | FixYes | Published06/17/2026 | SeverityCritical |
|---|
CVE-2026-49769WordPress wpForo Forum plugin <= 3.1.0 - PHP Object Injection vulnerability | Exploitation statusNot exploited | FixYes | Published06/15/2026 | SeverityCritical |
|---|
CVE-2026-40798WordPress wpForo Forum plugin <= 3.0.4 - SQL Injection vulnerability | Exploitation statusNot exploited | FixYes | Published06/15/2026 | SeverityCritical |
|---|
CVE-2026-40767WordPress wpForo Forum plugin < 3.0.2 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Published06/15/2026 | SeverityHigh |
|---|
CVE-2026-42682WordPress wpForo Forum plugin <= 3.0.6 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Published06/01/2026 | SeverityCritical |
|---|
CVE-2026-6248wpForo Forum <= 3.0.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Custom Profile Field File Path | Exploitation statusNot exploited | FixYes | Published04/20/2026 | SeverityHigh |
|---|
CVE-2026-4666wpForo Forum <= 2.4.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter | Exploitation statusNot exploited | FixYes | Published04/17/2026 | SeverityMedium |
|---|
CVE-2026-5809wpForo Forum <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter | Exploitation statusNot exploited | FixYes | Published04/11/2026 | SeverityHigh |
|---|
CVE-2026-3666wpForo Forum <= 2.4.16 - Authenticated (Subscriber+) Arbitrary File Deletion via Post Body | Exploitation statusNot exploited | FixYes | Published04/04/2026 | SeverityHigh |
|---|
CVE-2026-1581wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection | Exploitation statusNot exploited | FixYes | Published02/19/2026 | SeverityHigh |
|---|
CVE-2026-0910wpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection | Exploitation statusNot exploited | FixYes | Published02/11/2026 | SeverityHigh |
|---|
CVE-2025-66070WordPress wpForo Forum plugin <= 2.4.10 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Published12/18/2025 | SeverityHigh |
|---|
CVE-2025-13126wpForo Forum <= 2.4.12 - Unauthenticated SQL Injection | Exploitation statusNot exploited | FixYes | Published12/14/2025 | SeverityHigh |
|---|
CVE-2025-11740wpForo Forum <= 2.4.9 - Authenticated (Susbscriber+) SQL Injection | Exploitation statusNot exploited | FixYes | Published11/01/2025 | SeverityMedium |
|---|
CVE-2025-4203wpForo Forum <= 2.4.8 - Unauthenticated SQL Injection via get_members Function | Exploitation statusNot exploited | FixYes | Published10/25/2025 | SeverityHigh |
|---|
CVE-2025-58597WordPress wpForo Forum Plugin <= 2.4.6 - Insecure Direct Object References (IDOR) Vulnerability | Exploitation statusNot exploited | FixYes | Published09/03/2025 | SeverityMedium |
|---|
CVE-2025-4406wpForo Forum <= 2.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar | Exploitation statusNot exploited | FixYes | Published07/10/2025 | SeverityMedium |
|---|
CVE-2025-31420WordPress wpForo Forum plugin <= 2.4.2 - Privilege Escalation vulnerability | Exploitation statusNot exploited | FixYes | Published04/04/2025 | SeverityHigh |
|---|
CVE-2025-0764wpForo Forum <= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in update | Exploitation statusNot exploited | FixYes | Published02/28/2025 | SeverityMedium |
|---|
CVE-2024-3200wpForo Forum <= 2.3.3 - Authenticated (Contributor+) SQL Injection | Exploitation statusNot exploited | FixYes | Published06/01/2024 | SeverityCritical |
|---|
CVE-2023-2249wpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents | Exploitation statusNot exploited | FixYes | Published06/09/2023 | SeverityHigh |
|---|
32 Results | Page 1 of 1