Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-08
wpForo Forum - Security Vulnerability (CVE-2026-95870)
The wpForo Forum plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to, and including, 3.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires that a searchable topic form field of type checkbox, or a select/autocomplete field with isMultiChoice enabled, is registered…
PLUGIN
wpForo Forum
CVE-2026-95870
Risk Score
Threat Entry
Updated 2026-11-07
wpForo Forum - Security Vulnerability (CVE-2026-120532)
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post[body]' parameter in all versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
wpForo Forum
CVE-2026-120532
Risk Score
Threat Entry
Updated 2026-11-08
wpForo Forum - Security Vulnerability (CVE-2026-119164)
The wpForo Forum plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.2 via the `data[secondary_groupids]` parameter of the `wpforo_action_profile_update` POST handler. This is due to a type-confusion flaw in the secondary_groupids authorization guard within the `Members::update()` function in `classes/Members.php`, where casting a scalar CSV string (e.g. `"0,1"`) with `(array)` before `array_map('intval', …)` and `array_filter()` produces an empty array — causing the guard's outer conditional, and the else-branch that would otherwise strip the field from the update, to be bypassed entirely — while `encode()`/`decode()`…
PLUGIN
wpForo Forum
CVE-2026-119164
Risk Score
Threat Entry
Updated 2026-11-08
wpForo Forum - Security Vulnerability (CVE-2026-119155)
The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'href[locale]' parameter in all versions up to, and including, 3.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce required for exploitation is publicly issued to unauthenticated visitors on any forum page via the wpforo.nonces JavaScript object,…
PLUGIN
wpForo Forum
CVE-2026-119155
Risk Score
Threat Entry
Updated 2026-11-08
wpForo Forum - Security Vulnerability (CVE-2026-110004)
The wpForo Forum plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the theme_delete function in all versions up to, and including, 3.2.2 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This exploit chain is reachable only on sites where an administrator has created a custom wpForo secondary usergroup with a blank WordPress role and…
PLUGIN
wpForo Forum
CVE-2026-110004
Risk Score
Threat Entry
Updated 2026-09-25
wpForo Forum - Security Vulnerability (CVE-2026-80514)
The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site owner's metered AI credits.
PLUGIN
wpForo Forum
CVE-2026-80514
Risk Score
Threat Entry
Updated 2026-09-25
wpForo Forum - Security Vulnerability (CVE-2026-93747)
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'telegram' profile field in versions up to, and including, 3.1.6. This is due to insufficient input sanitization and output escaping in the profile_update action — the raw $_POST['data'] array is copied into a $custom_fields variable before validate() and sanitize() run, both of which operate only on a parallel $user reference, leaving $custom_fields unsanitized when it is persisted via update_custom_fields(); on render, wpforo_decode() reverses the entity encoding and the value is echoed without escaping in field_wrap_profile(). This…
PLUGIN
wpForo Forum
CVE-2026-93747
Risk Score
Threat Entry
Updated 2026-09-24
wpForo Forum - Security Vulnerability (CVE-2026-80513)
The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum WordPress plugin before 3.1.6 itself; if one is present via another installed wpForo Forum WordPress plugin before 3.1.6 or , this could lead to remote code execution, arbitrary file operations, or SQL injection. This is an incomplete fix of CVE-2026-49769.
PLUGIN
wpForo Forum
CVE-2026-80513
Risk Score
Threat Entry
Updated 2026-09-23
wpForo Forum - Security Vulnerability (CVE-2026-91092)
The wpForo Forum plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to take over another guest author's forum post and modify its title, body, author name, and stored owner email address. This requires that guest posting and editing are enabled on the forum, and that the attacker knows the target guest author's…
PLUGIN
wpForo Forum
CVE-2026-91092
Risk Score
Threat Entry
Updated 2026-08-28
wpForo Forum - SQL Injection (CVE-2026-5097)
The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'referer' parameter in all versions up to, and including, 2.4.17. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
wpForo Forum
CVE-2026-5097
Risk Score
Threat Entry
Updated 2026-08-26
wpForo Forum - Security Vulnerability (CVE-2026-12698)
The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing their own account, allowing users with a subscriber-level account to write administrator-controlled account-state and reputation fields on their own profile, including self-activating a pending or banned account and forging their forum reputation score.
PLUGIN
wpForo Forum
CVE-2026-12698
Risk Score
Threat Entry
Updated 2026-08-26
wpForo Forum - Cross-Site Scripting (XSS) (CVE-2026-12696)
The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor who views the profile, including a logged-in administrator.
PLUGIN
wpForo Forum
CVE-2026-12696
Risk Score
Threat Entry
Updated 2026-08-26
wpForo Forum - Security Vulnerability (CVE-2026-12697)
The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting user before deleting its messages, allowing users with a subscriber-level account to permanently delete the stored AI chat message history of any other user.
PLUGIN
wpForo Forum
CVE-2026-12697
Risk Score
Threat Entry
Updated 2026-07-16
wpForo Forum - Cross-Site Scripting (XSS) (CVE-2026-15021)
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'location' Profile Field in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The sanitize_text_field() function applied at input does not encode double quotes, allowing attribute breakout via a payload that escapes the href attribute context and injects event handler attributes.
PLUGIN
wpForo Forum
CVE-2026-15021
Risk Score
Threat Entry
Updated 2026-06-26
wpForo Forum - SQL Injection (CVE-2026-57636)
Contributor SQL Injection in wpForo Forum
PLUGIN
wpForo Forum
CVE-2026-57636
Risk Score
Threat Entry
Updated 2026-06-17
wpForo Forum - PHP Object Injection (CVE-2026-49769)
Unauthenticated PHP Object Injection in wpForo Forum
PLUGIN
wpForo Forum
CVE-2026-49769
Risk Score
Threat Entry
Updated 2026-06-17
wpForo Forum - SQL Injection (CVE-2026-40798)
Unauthenticated SQL Injection in wpForo Forum
PLUGIN
wpForo Forum
CVE-2026-40798
Risk Score
Threat Entry
Updated 2026-06-17
wpForo Forum - Remote Code Execution (CVE-2026-6248)
The wpForo Forum plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 3.0.5. This is due to two compounding flaws: the Members::update() method does not validate or restrict the value of file-type custom profile fields, allowing authenticated users to store an arbitrary path instead of a legitimate upload path; and the wpforo_fix_upload_dir() sanitization function in ucf_file_delete() only remaps paths that match the expected pattern, and it is passed directly to the unlink() function. This makes it possible for authenticated attackers, with subscriber-level access and…
PLUGIN
wpForo Forum
CVE-2026-6248
Risk Score
Threat Entry
Updated 2026-06-17
wpForo Forum - Security Vulnerability (CVE-2026-4666)
The wpForo Forum plugin for WordPress is vulnerable to unauthorized modification of data due to the use of `extract($args, EXTR_OVERWRITE)` on user-controlled input in the `edit()` method of `classes/Posts.php` in all versions up to, and including, 2.4.16. The `post_edit` action handler in `Actions.php` passes `$_REQUEST['post']` directly to `Posts::edit()`, which calls `extract($args, EXTR_OVERWRITE)`. An attacker can inject `post[guestposting]=1` to overwrite the local `$guestposting` variable, causing the entire permission check block to be skipped. The nonce check uses a hardcoded `wpforo_verify_form` action shared across all 8 forum templates, so any user who…
PLUGIN
wpForo Forum
CVE-2026-4666
Risk Score
Threat Entry
Updated 2026-06-17
wpForo Forum - Security Vulnerability (CVE-2026-5809)
The wpForo Forum plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 3.0.2. This is due to a two-step logic flaw: the topic_add() and topic_edit() action handlers accept arbitrary user-supplied data[*] arrays from $_REQUEST and store them as postmeta without restricting which fields may contain array values. Because 'body' is included in the allowed topic fields list, an attacker can supply data[body][fileurl] with an arbitrary file path (e.g., wp-config.php or an absolute server path). This poisoned fileurl is persisted to the plugin's custom postmeta…
PLUGIN
wpForo Forum
CVE-2026-5809
Risk Score