What’s Vulnerable › Products

tomdever wpForo Forum vulnerabilities

58 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 38 published in the last 12 months.

Check whether your tomdever wpForo Forum version is affected

Latest tomdever wpForo Forum vulnerabilities

• CVE-2026-80514 — wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit Bypass (CVSS 5.3)
• CVE-2026-93747 — wpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field (CVSS 6.4)
• CVE-2026-80513 — wpForo Forum < 3.1.6 - Subscriber+ PHP Object Injection via Profile Fields (CVSS 7.5)
• CVE-2026-93772 — WordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
• CVE-2026-91092 — wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie (CVSS 4.3)
• CVE-2026-5097 — wpForo Forum <= 2.4.17 - Unauthenticated SQL Injection via 'referer' Parameter (CVSS 7.5)
• CVE-2026-12698 — wpForo Forum < 3.1.3 - Subscriber+ Account Status and Reputation Manipulation via Profile Update Mass Assignment (CVSS 4.3)
• CVE-2026-12696 — wpForo Forum < 3.1.2 - Subscriber+ Stored XSS via Profile Location Field (CVSS 5.4)
• CVE-2026-12697 — wpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDOR (CVSS 5.4)
• CVE-2026-15021 — wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field (CVSS 6.4)
• CVE-2026-57636 — WordPress wpForo Forum plugin <= 3.0.9 - SQL Injection vulnerability (CVSS 8.5)
• CVE-2026-49767 — WordPress wpForo Forum plugin <= 3.1.0 - Broken Authentication vulnerability (CVSS 9.8)
• CVE-2026-49769 — WordPress wpForo Forum plugin <= 3.1.0 - PHP Object Injection vulnerability (CVSS 9.8)
• CVE-2026-40798 — WordPress wpForo Forum plugin <= 3.0.4 - SQL Injection vulnerability (CVSS 9.3)
• CVE-2026-40767 — WordPress wpForo Forum plugin < 3.0.2 - Broken Access Control vulnerability (CVSS 7.5)
• CVE-2026-42682 — WordPress wpForo Forum plugin <= 3.0.6 - Broken Access Control vulnerability (CVSS 9.1)
• CVE-2026-6248 — wpForo Forum <= 3.0.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Custom Profile Field File Path (CVSS 8.1)
• CVE-2026-4666 — wpForo Forum <= 2.4.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter (CVSS 6.5)
• CVE-2026-5809 — wpForo Forum <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter (CVSS 7.1)
• CVE-2026-3666 — wpForo Forum <= 2.4.16 - Authenticated (Subscriber+) Arbitrary File Deletion via Post Body (CVSS 8.8)
• CVE-2026-28562 — wpForo Forum 2.4.14 SQL Injection via Topics ORDER BY Parameter (CVSS 9.8)
• CVE-2026-28561 — wpForo Forum 2.4.14 Stored XSS via Unescaped Forum Description in Templates (CVSS 4.8)
• CVE-2026-28560 — wpForo Forum 2.4.14 Stored XSS via Unsafe JSON Encoding in Inline Script (CVSS 4.8)
• CVE-2026-28559 — wpForo Forum 2.4.14 Information Disclosure via Global RSS Feed (CVSS 5.3)
• CVE-2026-28558 — wpForo Forum 2.4.14 Stored XSS via SVG Avatar File Upload (CVSS 5.4)