Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-08-28
wpForo Forum - SQL Injection (CVE-2026-5097)
The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'referer' parameter in all versions up to, and including, 2.4.17. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
wpForo Forum
CVE-2026-5097
Risk Score
Threat Entry
Updated 2026-08-26
wpForo Forum - Security Vulnerability (CVE-2026-12698)
The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing their own account, allowing users with a subscriber-level account to write administrator-controlled account-state and reputation fields on their own profile, including self-activating a pending or banned account and forging their forum reputation score.
PLUGIN
wpForo Forum
CVE-2026-12698
Risk Score
Threat Entry
Updated 2026-08-26
wpForo Forum - Cross-Site Scripting (XSS) (CVE-2026-12696)
The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor who views the profile, including a logged-in administrator.
PLUGIN
wpForo Forum
CVE-2026-12696
Risk Score
Threat Entry
Updated 2026-08-26
wpForo Forum - Security Vulnerability (CVE-2026-12697)
The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting user before deleting its messages, allowing users with a subscriber-level account to permanently delete the stored AI chat message history of any other user.
PLUGIN
wpForo Forum
CVE-2026-12697
Risk Score
Threat Entry
Updated 2026-07-16
wpForo Forum - Cross-Site Scripting (XSS) (CVE-2026-15021)
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'location' Profile Field in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The sanitize_text_field() function applied at input does not encode double quotes, allowing attribute breakout via a payload that escapes the href attribute context and injects event handler attributes.
PLUGIN
wpForo Forum
CVE-2026-15021
Risk Score
Threat Entry
Updated 2026-06-26
wpForo Forum - SQL Injection (CVE-2026-57636)
Contributor SQL Injection in wpForo Forum
PLUGIN
wpForo Forum
CVE-2026-57636
Risk Score
Threat Entry
Updated 2026-06-17
wpForo Forum - PHP Object Injection (CVE-2026-49769)
Unauthenticated PHP Object Injection in wpForo Forum
PLUGIN
wpForo Forum
CVE-2026-49769
Risk Score
Threat Entry
Updated 2026-06-17
wpForo Forum - SQL Injection (CVE-2026-40798)
Unauthenticated SQL Injection in wpForo Forum
PLUGIN
wpForo Forum
CVE-2026-40798
Risk Score
Threat Entry
Updated 2026-06-17
wpForo Forum - Remote Code Execution (CVE-2026-6248)
The wpForo Forum plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 3.0.5. This is due to two compounding flaws: the Members::update() method does not validate or restrict the value of file-type custom profile fields, allowing authenticated users to store an arbitrary path instead of a legitimate upload path; and the wpforo_fix_upload_dir() sanitization function in ucf_file_delete() only remaps paths that match the expected pattern, and it is passed directly to the unlink() function. This makes it possible for authenticated attackers, with subscriber-level access and…
PLUGIN
wpForo Forum
CVE-2026-6248
Risk Score
Threat Entry
Updated 2026-06-17
wpForo Forum - Security Vulnerability (CVE-2026-4666)
The wpForo Forum plugin for WordPress is vulnerable to unauthorized modification of data due to the use of `extract($args, EXTR_OVERWRITE)` on user-controlled input in the `edit()` method of `classes/Posts.php` in all versions up to, and including, 2.4.16. The `post_edit` action handler in `Actions.php` passes `$_REQUEST['post']` directly to `Posts::edit()`, which calls `extract($args, EXTR_OVERWRITE)`. An attacker can inject `post[guestposting]=1` to overwrite the local `$guestposting` variable, causing the entire permission check block to be skipped. The nonce check uses a hardcoded `wpforo_verify_form` action shared across all 8 forum templates, so any user who…
PLUGIN
wpForo Forum
CVE-2026-4666
Risk Score
Threat Entry
Updated 2026-06-17
wpForo Forum - Security Vulnerability (CVE-2026-5809)
The wpForo Forum plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 3.0.2. This is due to a two-step logic flaw: the topic_add() and topic_edit() action handlers accept arbitrary user-supplied data[*] arrays from $_REQUEST and store them as postmeta without restricting which fields may contain array values. Because 'body' is included in the allowed topic fields list, an attacker can supply data[body][fileurl] with an arbitrary file path (e.g., wp-config.php or an absolute server path). This poisoned fileurl is persisted to the plugin's custom postmeta…
PLUGIN
wpForo Forum
CVE-2026-5809
Risk Score
Threat Entry
Updated 2026-07-24
wpForo Forum - Path Traversal (CVE-2026-3666)
The wpForo Forum plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 2.4.16. This is due to a missing file name/path validation against path traversal sequences. This makes it possible for authenticated attackers, with subscriber level access and above, to delete arbitrary files on the server by embedding a crafted path traversal string in a forum post body and then deleting the post.
PLUGIN
wpForo Forum
CVE-2026-3666
Risk Score
Threat Entry
Updated 2026-06-17
Wpforo Forum - SQL Injection (CVE-2026-28562)
wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payloads to perform blind boolean extraction of credentials from the WordPress database.
PLUGIN
Wpforo Forum
CVE-2026-28562
Risk Score
Threat Entry
Updated 2026-06-17
Wpforo Forum - Cross-Site Scripting (XSS) (CVE-2026-28561)
wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows administrators to inject persistent JavaScript via forum description fields echoed without output escaping across multiple theme template files. On multisite installations or with a compromised admin account, attackers set a forum description containing HTML event handlers that execute when any user views the forum listing.
PLUGIN
Wpforo Forum
CVE-2026-28561
Risk Score
Threat Entry
Updated 2026-06-17
Wpforo Forum - Cross-Site Scripting (XSS) (CVE-2026-28560)
wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inline script block using json_encode without the JSON_HEX_TAG flag. Attackers set a forum slug containing a closing script tag or unescaped single quote to break out of the JavaScript string context and execute arbitrary script in all visitors' browsers.
PLUGIN
Wpforo Forum
CVE-2026-28560
Risk Score
Threat Entry
Updated 2026-06-17
Wpforo Forum - Broken Access Control (CVE-2026-28557)
wpForo Forum 2.4.14 contains a missing capability check vulnerability that allows authenticated users to trigger bulk wpForo usergroup reassignment via the wpforo_synch_roles AJAX handler. Attackers access the usergroups admin page, accessible to any authenticated user, to obtain a nonce, then remap all wpForo usergroups to arbitrary WordPress roles.
PLUGIN
Wpforo Forum
CVE-2026-28557
Risk Score
Threat Entry
Updated 2026-06-17
Wpforo Forum - Information Disclosure (CVE-2026-28559)
wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retrieve private and unapproved forum topics via the global RSS feed endpoint. Attackers request the RSS feed without a forum ID parameter, bypassing the privacy and status WHERE clauses that are only applied when a specific forum ID is present in the query.
PLUGIN
Wpforo Forum
CVE-2026-28559
Risk Score
Threat Entry
Updated 2026-06-17
Wpforo Forum - Broken Access Control (CVE-2026-28556)
wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to move, merge, or split any forum topic via the topic_move, topic_merge, and topic_split form action handlers. Attackers with a valid form nonce can reorganize arbitrary forum content without moderator permissions, including relocating topics to private forums.
PLUGIN
Wpforo Forum
CVE-2026-28556
Risk Score
Threat Entry
Updated 2026-06-17
Wpforo Forum - Broken Access Control (CVE-2026-28555)
wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to close or reopen any forum topic via the wpforo_close_ajax handler. Attackers submit a valid nonce with an arbitrary topic ID to bypass the moderator permission requirement and disrupt forum discussions.
PLUGIN
Wpforo Forum
CVE-2026-28555
Risk Score
Threat Entry
Updated 2026-06-17
Wpforo Forum - Cross-Site Scripting (XSS) (CVE-2026-28558)
wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows authenticated subscribers to upload SVG files as profile avatars through the avatar upload functionality. Attackers upload a crafted SVG containing CSS injection or JavaScript event handlers that execute in the browsers of any user who views the attacker's profile page.
PLUGIN
Wpforo Forum
CVE-2026-28558
Risk Score