WordPress security by component
wpForo Forum
Plugin description
wpForo Forum is a WordPress component with 47 published CVE records in this archive. The latest tracked vulnerability was published Jul 16, 2026; the highest CVE/CNA score is 9.9.
Plugin slug:
wpforoLatest vulnerability
CVE-2026-15021: wpForo Forum: Cross-site scripting
wpForo Forum is affected by cross-site scripting. Exploitation requires at least subscriber-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 3.1.1.
| Safe version |
|
||
|---|---|---|---|
| Jul 16, 2026 |
CVE-2026-15021
wpForo Forum: Cross-site scripting
wpForo Forum is affected by cross-site scripting. Exploitation requires at least subscriber-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 3.1.1.
|
> 3.1.1 |
CVE6.4
NVDPending
|
| Jun 26, 2026 |
CVE-2026-57636
wpForo Forum: SQL injection
wpForo Forum is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 3.0.9.
|
3.1.0 |
CVE8.5
NVDPending
|
| Jun 17, 2026 |
CVE-2026-49767
wpForo Forum: A security weakness
wpForo Forum is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 3.1.0.
|
3.1.1 |
CVE9.8
NVDPending
|
| Jun 15, 2026 |
CVE-2026-49769
wpForo Forum: Code execution
wpForo Forum is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is n/a through 3.1.0.
|
3.1.1 |
CVE9.8
NVDPending
|
| Jun 15, 2026 |
CVE-2026-40798
wpForo Forum: SQL injection
wpForo Forum is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 3.0.4.
|
3.0.5 |
CVE9.3
NVDPending
|
| Jun 15, 2026 |
CVE-2026-40767
wpForo Forum: A security weakness
wpForo Forum is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a to < 3.0.2.
|
3.0.2 |
CVE7.5
NVDPending
|
| Jun 01, 2026 |
CVE-2026-42682
wpForo Forum: A security weakness
wpForo Forum is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 3.0.6.
|
3.0.7 |
CVE9.1
NVDPending
|
| Apr 20, 2026 |
CVE-2026-6248
wpForo Forum: Code execution
wpForo Forum is affected by code execution. Exploitation requires at least subscriber-level access. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is <= 3.0.5.
|
> 3.0.5 |
CVE8.1
NVDPending
|
| Apr 17, 2026 |
CVE-2026-4666
wpForo Forum: A security weakness
wpForo Forum is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 2.4.16.
|
> 2.4.16 |
CVE6.5
NVDPending
|
| Apr 11, 2026 |
CVE-2026-5809
wpForo Forum: Arbitrary file deletion
wpForo Forum is affected by arbitrary file deletion. Exploitation requires at least subscriber-level access. A successful request can remove files outside the intended scope and may make the site unavailable. The published affected range is <= 3.0.2.
|
> 3.0.2 |
CVE7.1
NVDPending
|
| Feb 28, 2026 |
CVE-2026-28562
Wpforo: SQL injection
Wpforo is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE8.8
NVD9.8
|
| Feb 28, 2026 |
CVE-2026-28561
Wpforo: Cross-site scripting
Wpforo is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE4.8
NVD4.8
|
| Feb 28, 2026 |
CVE-2026-28560
Wpforo: Cross-site scripting
Wpforo is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE4.8
NVD4.8
|
| Feb 28, 2026 |
CVE-2026-28559
Wpforo: Sensitive information exposure
Wpforo is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.
|
See mitigation notes |
CVE6.9
NVDPending
|
| Feb 28, 2026 |
CVE-2026-28558
Wpforo: Cross-site scripting
Wpforo is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.1
NVD5.4
|
| Feb 28, 2026 |
CVE-2026-28557
Wpforo: A security weakness
Wpforo is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE7.1
NVDPending
|
| Feb 28, 2026 |
CVE-2026-28556
Wpforo: A security weakness
Wpforo is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVD5.4
|
| Feb 28, 2026 |
CVE-2026-28555
Wpforo: A security weakness
Wpforo is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Feb 28, 2026 |
CVE-2026-28554
Wpforo: A security weakness
Wpforo is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Feb 19, 2026 |
CVE-2026-1581
wpForo Forum: SQL injection
wpForo Forum is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE7.5
NVDPending
|
| Feb 11, 2026 |
CVE-2026-0910
wpForo Forum: Code execution
wpForo Forum is affected by code execution. Exploitation requires at least subscriber-level access. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE8.8
NVDPending
|
| Dec 18, 2025 |
CVE-2025-66070
wpForo Forum: A security weakness
wpForo Forum is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE7.5
NVDPending
|
| Dec 14, 2025 |
CVE-2025-13126
wpForo Forum: SQL injection
wpForo Forum is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE7.5
NVDPending
|
| Oct 25, 2025 |
CVE-2025-4203
wpForo Forum: SQL injection
wpForo Forum is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE7.5
NVDPending
|
| Sep 03, 2025 |
CVE-2025-58597
wpForo Forum: A security weakness
wpForo Forum is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Jul 10, 2025 |
CVE-2025-4406
wpForo Forum: Cross-site scripting
wpForo Forum is affected by cross-site scripting. Exploitation requires at least subscriber-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.4
NVDPending
|
| Apr 04, 2025 |
CVE-2025-31420
wpForo Forum: Privilege escalation or authentication bypass
wpForo Forum is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.
|
See mitigation notes |
CVE7.6
NVDPending
|
| Aug 26, 2024 |
CVE-2024-43289
wpForo Forum: A security weakness
wpForo Forum is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE7.5
NVD7.5
|
| Aug 18, 2024 |
CVE-2024-43288
wpForo Forum: A security weakness
wpForo Forum is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
NVD8.1
|
| Jun 21, 2024 |
CVE-2022-38055
wpForo Forum: Cross-site scripting
wpForo Forum is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE4.3
NVD5.4
|
| May 17, 2024 |
CVE-2023-47868
wpForo Forum: Privilege escalation or authentication bypass
wpForo Forum is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.
|
See mitigation notes |
CVE7.3
NVD9.8
|
| Nov 30, 2023 |
CVE-2023-47870
wpForo Forum: Cross-site request forgery
wpForo Forum is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE5.7
NVD8.8
|
| Nov 30, 2023 |
CVE-2023-47872
wpForo Forum: Cross-site scripting
wpForo Forum is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
NVD5.4
|
| Jun 09, 2023 |
CVE-2023-2249
wpForo Forum: Code execution
wpForo Forum is affected by code execution. Exploitation requires an authenticated WordPress account. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE8.8
NVD8.8
|
| Nov 17, 2022 |
CVE-2022-40200
Wpforo: Dangerous file upload
Wpforo is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.
|
See mitigation notes |
CVE9.9
NVD8.8
|
| Nov 17, 2022 |
CVE-2022-40192
Wpforo: Cross-site request forgery
Wpforo is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE7.1
NVD8.8
|
| Nov 08, 2022 |
CVE-2022-40632
Wpforo: Cross-site request forgery
Wpforo is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE5.4
NVD5.4
|
| Nov 08, 2022 |
CVE-2022-40206
Wpforo: A security weakness
Wpforo is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE6.3
NVD4.3
|
| Nov 08, 2022 |
CVE-2022-40205
Wpforo: A security weakness
Wpforo is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.4
NVD4.3
|
| Sep 09, 2022 |
CVE-2022-38144
Wpforo: Cross-site request forgery
Wpforo is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE8.8
NVD8.8
|
| Jun 15, 2020 |
CVE-2019-19112
Wpforo: Cross-site scripting
Wpforo is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVD6.1
|
| Jun 15, 2020 |
CVE-2019-19111
Wpforo: Cross-site scripting
Wpforo is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVD6.1
|
| Jun 15, 2020 |
CVE-2019-19110
Wpforo: Cross-site scripting
Wpforo is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE4.8
NVD4.8
|
| Jun 15, 2020 |
CVE-2019-19109
Wpforo: Cross-site request forgery
Wpforo is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE8.8
NVD8.8
|
| Jun 19, 2019 |
CVE-2018-16613
Wpforo: A security weakness
Wpforo is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE9.8
NVD9.8
|
| Jun 04, 2018 |
CVE-2018-11709
Wpforo: Cross-site scripting
Wpforo is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVD6.1
|
| May 28, 2018 |
CVE-2018-11515
Wpforo: SQL injection
Wpforo is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE9.8
NVD9.8
|