Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

wpForo Forum — Vulnerabilities & Security Advisories 44

All 44 CVE vulnerabilities found in wpForo Forum, with AI-generated Chinese analysis, references, and POCs.

This page catalogs documented security weaknesses associated with the wpForo Forum product developed by the vendor wpForo. It serves as a centralized repository for tracking reported vulnerabilities, allowing security professionals to assess the risk landscape specific to this popular WordPress forum plugin. The collection includes a comprehensive range of vulnerability types, such as cross-site scripting, unauthorized access, and injection flaws, covering advisory data released from 2019 to the present. By aggregating these entries, the page provides a historical perspective on how the software’s security posture has evolved over time. It captures both critical and low-severity issues, offering a complete view of the exposure timeline without filtering out less prominent incidents. Users can utilize this resource to track vendor advisories and monitor the resolution status of specific issues. It enables analysts to understand the prevalence and nature of weakness classes within the wpForo ecosystem, facilitating better threat modeling and patch management decisions. Additionally, the page supports detailed lookup of a product’s vulnerability history, helping administrators evaluate the long-term security maintenance practices of the project. This data-driven approach aids in making informed decisions regarding software upgrades and security configurations, ensuring that stakeholders have access to reliable and chronological security intelligence for effective risk mitigation.

Vendor: gVectors Team

CVE IDTitleCVSSSeverityPublished
CVE-2026-12698 wpForo Forum < 3.1.3 - Subscriber+ Account Status and Reputation Manipulation via Profile Update Mass Assignment --2026-08-04
CVE-2026-12696 wpForo Forum < 3.1.2 - Subscriber+ Stored XSS via Profile Location Field --2026-08-01
CVE-2026-12697 wpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDOR --2026-07-31
CVE-2026-15021 wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field CWE-79 6.4 Medium2026-07-16
CVE-2026-57636 WordPress wpForo Forum plugin <= 3.0.9 - SQL Injection vulnerability CWE-89 8.5 High2026-06-26
CVE-2026-49767 WordPress wpForo Forum plugin <= 3.1.0 - Broken Authentication vulnerability CWE-288 9.8 Critical2026-06-17
CVE-2026-49769 WordPress wpForo Forum plugin <= 3.1.0 - PHP Object Injection vulnerability CWE-502 9.8 Critical2026-06-15
CVE-2026-40798 WordPress wpForo Forum plugin <= 3.0.4 - SQL Injection vulnerability CWE-89 9.3 Critical2026-06-15
CVE-2026-40767 WordPress wpForo Forum plugin < 3.0.2 - Broken Access Control vulnerability CWE-281 7.5 High2026-06-15
CVE-2026-42682 WordPress wpForo Forum plugin <= 3.0.6 - Broken Access Control vulnerability CWE-862 9.1 Critical2026-06-01
CVE-2026-6248 wpForo Forum <= 3.0.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Custom Profile Field File Path CWE-22 8.1 High2026-04-20
CVE-2026-4666 wpForo Forum <= 2.4.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter CWE-862 6.5 Medium2026-04-17
CVE-2026-5809 wpForo Forum <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter CWE-73 7.1 High2026-04-11
CVE-2026-3666 wpForo Forum <= 2.4.16 - Authenticated (Subscriber+) Arbitrary File Deletion via Post Body CWE-22 8.8 High2026-04-04
CVE-2026-28562 wpForo Forum 2.4.14 SQL Injection via Topics ORDER BY Parameter CWE-89 8.2 High2026-02-28
CVE-2026-28561 wpForo Forum 2.4.14 Stored XSS via Unescaped Forum Description in Templates CWE-79 5.5 Medium2026-02-28
CVE-2026-28560 wpForo Forum 2.4.14 Stored XSS via Unsafe JSON Encoding in Inline Script CWE-79 5.5 Medium2026-02-28
CVE-2026-28559 wpForo Forum 2.4.14 Information Disclosure via Global RSS Feed CWE-200 5.3 Medium2026-02-28
CVE-2026-28558 wpForo Forum 2.4.14 Stored XSS via SVG Avatar File Upload CWE-79 6.4 Medium2026-02-28
CVE-2026-28557 wpForo Forum < 2.4.16 Privilege Escalation via Role Synchronization Handler CWE-862 6.5 Medium2026-02-28
CVE-2026-28555 wpForo Forum 2.4.14 Missing Authorization via Topic Close AJAX Handler CWE-862 4.3 Medium2026-02-28
CVE-2026-28556 wpForo Forum 2.4.14 Missing Authorization via Topic Management Form Handlers CWE-862 5.4 Medium2026-02-28
CVE-2026-28554 wpForo Forum 2.4.14 Missing Authorization via Post Approval AJAX Handler CWE-862 4.3 Medium2026-02-28
CVE-2026-1581 wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection CWE-89 7.5 High2026-02-19
CVE-2026-0910 wpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection CWE-502 8.8 High2026-02-11
CVE-2025-66070 WordPress wpForo Forum plugin <= 2.4.10 - Broken Access Control vulnerability CWE-862 7.5 High2025-12-18
CVE-2025-13126 wpForo Forum <= 2.4.12 - Unauthenticated SQL Injection CWE-89 7.5 High2025-12-14
CVE-2025-11740 wpForo Forum <= 2.4.9 - Authenticated (Susbscriber+) SQL Injection CWE-89 6.5 Medium2025-11-01
CVE-2025-4203 wpForo Forum <= 2.4.8 - Unauthenticated SQL Injection via get_members Function CWE-89 7.5 High2025-10-25
CVE-2025-58597 WordPress wpForo Forum Plugin <= 2.4.6 - Insecure Direct Object References (IDOR) Vulnerability CWE-639 4.3 Medium2025-09-03

All 44 known CVE vulnerabilities affecting wpForo Forum with full Chinese analysis, references, and POCs where available.