wpForo Forum: known security problems
54 known security problems reported for this WordPress plugin, with the affected versions, the fix and what to do.
Updated
In short
There are 54 known security problems on this page. Each one has a fixed version. Updating to version 3.1.7 or newer covers every fixed problem listed here.
Based on public reports. Check the plugin’s changelog. Watchfox AI may be wrong.
Get an email when your site is affected: install Watchfox AI (free)
Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 3.1.6)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 3.1.6
- Fixed in
- 3.1.7
- What to do
- If your site has an affected version, update wpForo Forum to version 3.1.7 or newer.
- Official ID
- CVE-2026-93747
- Report title
- wpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field
- First reported
- Sources
- Wordfence, seen
Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 3.1.5)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 3.1.5
- Fixed in
- 3.1.6
- What to do
- If your site has an affected version, update wpForo Forum to version 3.1.6 or newer.
- Official ID
- CVE-2026-93772
- Report title
- wpForo Forum <= 3.1.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- First reported
- Sources
- Wordfence, seen
Anyone with an account on your site, even a basic one could in some setups, take over your site (up to and including 3.1.5)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 3.1.5
- Fixed in
- 3.1.6
- What to do
- If your site has an affected version, update wpForo Forum to version 3.1.6 or newer.
- Official ID
- CVE-2026-80513
- Report title
- wpForo Forum <= 3.1.5 - Authenticated (Subscriber+) PHP Object Injection
- First reported
- Sources
- Wordfence, seen
A stranger could use it to harm your site
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- From 3.0.0 up to and including 3.1.5
- Fixed in
- 3.1.6
- What to do
- If your site has an affected version, update wpForo Forum to version 3.1.6 or newer.
- Official ID
- CVE-2026-80514
- Report title
- wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion
- First reported
- Sources
- Wordfence, seen
Anyone with an account on your site, even a basic one could do things on your site they should not be allowed to (up to and including 3.1.5)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 3.1.5
- Fixed in
- 3.1.6
- What to do
- If your site has an affected version, update wpForo Forum to version 3.1.6 or newer.
- Official ID
- CVE-2026-91092
- Report title
- wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie
- First reported
- Sources
- Wordfence, seen
A stranger could read or change the data in your site’s database (up to and including 2.4.17)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 2.4.17
- Fixed in
- 3.0.0
- What to do
- If your site has an affected version, update wpForo Forum to version 3.0.0 or newer.
- Official ID
- CVE-2026-5097
- Report title
- wpForo Forum <= 2.4.17 - Unauthenticated SQL Injection via 'referer' Parameter
- First reported
- Sources
- Wordfence, seen
Anyone with an account on your site, even a basic one could do things on your site they should not be allowed to (up to and including 3.1.2)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 3.1.2
- Fixed in
- 3.1.3
- What to do
- If your site has an affected version, update wpForo Forum to version 3.1.3 or newer.
- Official ID
- CVE-2026-12698
- Report title
- wpForo Forum <= 3.1.2 - Missing Authorization to Authenticated (Subscriber+) Account Status Manipulation
- First reported
- Sources
- Wordfence, seen
Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 3.1.1)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 3.1.1
- Fixed in
- 3.1.2
- What to do
- If your site has an affected version, update wpForo Forum to version 3.1.2 or newer.
- Official ID
- CVE-2026-12696
- Report title
- wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- First reported
- Sources
- Wordfence, seen
Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 3.1.1)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 3.1.1
- Fixed in
- 3.1.2
- What to do
- If your site has an affected version, update wpForo Forum to version 3.1.2 or newer.
- Official ID
- CVE-2026-12697
- Report title
- wpForo Forum <= 3.1.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Chat Message Deletion
- First reported
- Sources
- Wordfence, seen
Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 3.1.1) (2)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 3.1.1
- Fixed in
- 3.1.2
- What to do
- If your site has an affected version, update wpForo Forum to version 3.1.2 or newer.
- Official ID
- CVE-2026-15021
- Report title
- wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field
- First reported
- Sources
- Wordfence, seen
Someone with a contributor account on your site could read or change the data in your site’s database (up to and including 3.0.9)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 3.0.9
- Fixed in
- 3.1.0
- What to do
- If your site has an affected version, update wpForo Forum to version 3.1.0 or newer.
- Official ID
- CVE-2026-57636
- Report title
- wpForo Forum <= 3.0.9 - Authenticated (Contributor+) SQL Injection
- First reported
- Sources
- Wordfence, seen
Someone could do things on your site they should not be allowed to (up to and including 3.1.0)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 3.1.0
- Fixed in
- 3.1.1
- What to do
- If your site has an affected version, update wpForo Forum to version 3.1.1 or newer.
- Official ID
- CVE-2026-49767
- Report title
- wpForo Forum <= 3.1.0 - Missing Authorization
- First reported
- Sources
- Wordfence, seen
A stranger could in some setups, take over your site
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 3.1.0
- Fixed in
- 3.1.1
- What to do
- If your site has an affected version, update wpForo Forum to version 3.1.1 or newer.
- Official ID
- CVE-2026-49769
- Report title
- wpForo Forum <= 3.1.0 - Unauthenticated PHP Object Injection
- First reported
- Sources
- Wordfence, seen
Someone could do things on your site they should not be allowed to (up to and including 3.0.6)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 3.0.6
- Fixed in
- 3.0.7
- What to do
- If your site has an affected version, update wpForo Forum to version 3.0.7 or newer.
- Official ID
- CVE-2026-42682
- Report title
- wpForo Forum <= 3.0.6 - Missing Authorization
- First reported
- Sources
- Wordfence, seen
A stranger could read or change the data in your site’s database (up to and including 3.0.4)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 3.0.4
- Fixed in
- 3.0.5
- What to do
- If your site has an affected version, update wpForo Forum to version 3.0.5 or newer.
- Official ID
- CVE-2026-40798
- Report title
- wpForo Forum <= 3.0.4 - Unauthenticated SQL Injection
- First reported
- Sources
- Wordfence, seen
Someone could do things on your site they should not be allowed to (before 3.0.2)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Before 3.0.2
- Fixed in
- 3.0.2
- What to do
- If your site has an affected version, update wpForo Forum to version 3.0.2 or newer.
- Official ID
- CVE-2026-40767
- Report title
- wpForo Forum < 3.0.2 - Missing Authorization
- First reported
- Sources
- Wordfence, seen
Anyone with an account on your site, even a basic one could read or delete private files on your server (up to and including 3.0.5)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 3.0.5
- Fixed in
- 3.0.6
- What to do
- If your site has an affected version, update wpForo Forum to version 3.0.6 or newer.
- Official ID
- CVE-2026-6248
- Report title
- wpForo Forum <= 3.0.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Custom Profile Field File Path
- First reported
- Sources
- Wordfence, seen
Anyone with an account on your site, even a basic one could do things on your site they should not be allowed to (up to and including 2.4.16)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 2.4.16
- Fixed in
- 3.0.0
- What to do
- If your site has an affected version, update wpForo Forum to version 3.0.0 or newer.
- Official ID
- CVE-2026-4666
- Report title
- wpForo Forum <= 2.4.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter
- First reported
- Sources
- Wordfence, seen
Anyone with an account on your site, even a basic one could read or delete private files on your server (up to and including 3.0.2)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 3.0.2
- Fixed in
- 3.0.3
- What to do
- If your site has an affected version, update wpForo Forum to version 3.0.3 or newer.
- Official ID
- CVE-2026-5809
- Report title
- wpForo Forum <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter
- First reported
- Sources
- Wordfence, seen
Anyone with an account on your site, even a basic one could read or delete private files on your server (up to and including 2.4.16)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 2.4.16
- Fixed in
- 2.4.17
- What to do
- If your site has an affected version, update wpForo Forum to version 2.4.17 or newer.
- Official ID
- CVE-2026-3666
- Report title
- wpForo Forum <= 2.4.16 - Authenticated (Subscriber+) Arbitrary File Deletion via Post Body
- First reported
- Sources
- Wordfence, seen
A stranger could read or change the data in your site’s database (up to and including 2.4.14)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 2.4.14
- Fixed in
- 2.4.15
- What to do
- If your site has an affected version, update wpForo Forum to version 2.4.15 or newer.
- Official ID
- CVE-2026-1581
- Report title
- wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection
- First reported
- Sources
- Wordfence, seen
Anyone with an account on your site, even a basic one could in some setups, take over your site (up to and including 2.4.13)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 2.4.13
- Fixed in
- 2.4.14
- What to do
- If your site has an affected version, update wpForo Forum to version 2.4.14 or newer.
- Official ID
- CVE-2026-0910
- Report title
- wpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection
- First reported
- Sources
- Wordfence, seen
A stranger could read or change the data in your site’s database (up to and including 2.4.12)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 2.4.12
- Fixed in
- 2.4.13
- What to do
- If your site has an affected version, update wpForo Forum to version 2.4.13 or newer.
- Official ID
- CVE-2025-13126
- Report title
- wpForo Forum <= 2.4.12 - Unauthenticated SQL Injection
- First reported
- Sources
- Wordfence, seen
Someone could do things on your site they should not be allowed to (up to and including 2.4.10)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 2.4.10
- Fixed in
- 2.4.11
- What to do
- If your site has an affected version, update wpForo Forum to version 2.4.11 or newer.
- Official ID
- CVE-2025-66070
- Report title
- wpForo Forum <= 2.4.10 - Missing Authorization
- First reported
- Sources
- Wordfence, seen
Someone could read or change the data in your site’s database (up to and including 2.4.9)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 2.4.9
- Fixed in
- 2.4.10
- What to do
- If your site has an affected version, update wpForo Forum to version 2.4.10 or newer.
- Official ID
- CVE-2025-11740
- Report title
- wpForo Forum <= 2.4.9 - Authenticated (Susbscriber+) SQL Injection
- First reported
- Sources
- Wordfence, seen
A stranger could read or change the data in your site’s database (up to and including 2.4.8)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 2.4.8
- Fixed in
- 2.4.9
- What to do
- If your site has an affected version, update wpForo Forum to version 2.4.9 or newer.
- Official ID
- CVE-2025-4203
- Report title
- wpForo Forum <= 2.4.8 - Unauthenticated SQL Injection via get_members Function
- First reported
- Sources
- Wordfence, seen
Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 2.4.6)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 2.4.6
- Fixed in
- 2.4.7
- What to do
- If your site has an affected version, update wpForo Forum to version 2.4.7 or newer.
- Official ID
- CVE-2025-58597
- Report title
- wpForo Forum <= 2.4.6 - Authenticated (Subscriber+) Insecure Direct Object Reference
- First reported
- Sources
- Wordfence, seen
Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 2.4.5)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 2.4.5
- Fixed in
- 2.4.6
- What to do
- If your site has an affected version, update wpForo Forum to version 2.4.6 or newer.
- Official ID
- CVE-2025-4406
- Report title
- wpForo Forum <= 2.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar
- First reported
- Sources
- Wordfence, seen
Anyone with an account on your site, even a basic one could take over your site as an admin
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 2.4.3
- Fixed in
- 2.4.4
- What to do
- If your site has an affected version, update wpForo Forum to version 2.4.4 or newer.
- Official ID
- CVE-2025-31420
- Report title
- wpForo Forum <= 2.4.3 - Authenticated (Subscriber+) Privilege Escalation
- First reported
- Sources
- Wordfence, seen
Anyone with an account on your site, even a basic one could read or delete private files on your server (up to and including 2.4.1)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 2.4.1
- Fixed in
- 2.4.2
- What to do
- If your site has an affected version, update wpForo Forum to version 2.4.2 or newer.
- Official ID
- CVE-2025-0764
- Report title
- wpForo Forum <= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in update
- First reported
- Sources
- Wordfence, seen
A stranger could see private information they should not see
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 2.3.4
- Fixed in
- 2.3.5
- What to do
- If your site has an affected version, update wpForo Forum to version 2.3.5 or newer.
- Official ID
- CVE-2024-43289
- Report title
- wpForo Forum <= 2.3.4 - Unauthenticated Sensitive Information Exposure
- First reported
- Sources
- Wordfence, seen
Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 2.3.4)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 2.3.4
- Fixed in
- 2.3.5
- What to do
- If your site has an affected version, update wpForo Forum to version 2.3.5 or newer.
- Official ID
- CVE-2024-43288
- Report title
- wpForo Forum <= 2.3.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
- First reported
- Sources
- Wordfence, seen
Someone with a contributor account on your site could read or change the data in your site’s database (up to and including 2.3.3)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 2.3.3
- Fixed in
- 2.3.4
- What to do
- If your site has an affected version, update wpForo Forum to version 2.3.4 or newer.
- Official ID
- CVE-2024-3200
- Report title
- wpForo Forum <= 2.3.3 - Authenticated (Contributor+) SQL Injection
- First reported
- Sources
- Wordfence, seen
A stranger could take over your site as an admin
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 2.2.3
- Fixed in
- 2.2.4
- What to do
- If your site has an affected version, update wpForo Forum to version 2.2.4 or newer.
- Official ID
- CVE-2023-47868
- Report title
- wpForo Forum <= 2.2.3 - Unauthenticated Privilege Escalation
- First reported
- Sources
- Wordfence, seen
Someone could trick a logged-in admin into changing settings without knowing (up to and including 2.2.8)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 2.2.8
- Fixed in
- 2.2.9
- What to do
- If your site has an affected version, update wpForo Forum to version 2.2.9 or newer.
- Official ID
- CVE-2023-47870
- Report title
- wpForo Forum <= 2.2.8 - Cross-Site Request Forgery via logout()
- First reported
- Sources
- Wordfence, seen
Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 2.2.3)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 2.2.3
- Fixed in
- 2.2.4
- What to do
- If your site has an affected version, update wpForo Forum to version 2.2.4 or newer.
- Official ID
- CVE-2023-47872
- Report title
- wpForo Forum <= 2.2.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- First reported
- Sources
- Wordfence, seen
Someone could do things on your site they should not be allowed to (up to and including 2.2.5)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 2.2.5
- Fixed in
- 2.2.6
- What to do
- If your site has an affected version, update wpForo Forum to version 2.2.6 or newer.
- Official ID
- CVE-2023-47869
- Report title
- wpForo Forum <= 2.2.5 - Missing Authorization
- First reported
- Sources
- Wordfence, seen
Someone could plant harmful code that runs for your visitors or admins (up to and including 2.1.8)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 2.1.8
- Fixed in
- 2.1.9
- What to do
- If your site has an affected version, update wpForo Forum to version 2.1.9 or newer.
- Official ID
- CVE-2023-2309
- Report title
- wpForo Forum <= 2.1.8 - Reflected Cross-Site Scripting via 'wpforo_debug'
- First reported
- Sources
- Wordfence, seen
Anyone with an account on your site, even a basic one could make your server visit other addresses on their behalf
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 2.1.7
- Fixed in
- 2.1.8
- What to do
- If your site has an affected version, update wpForo Forum to version 2.1.8 or newer.
- Official ID
- CVE-2023-2249
- Report title
- wpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents
- First reported
- Sources
- Wordfence, seen
Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 2.0.9)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 2.0.9
- Fixed in
- 2.1.0
- What to do
- If your site has an affected version, update wpForo Forum to version 2.1.0 or newer.
- Official ID
- CVE-2022-38055
- Report title
- wpForo Forum <= 2.0.9 - Authenticated (Subscriber+) HTML Injection
- First reported
- Sources
- Wordfence, seen
Someone could use it to harm your site (up to and including 2.0.5)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 2.0.5
- Fixed in
- 2.0.6
- What to do
- If your site has an affected version, update wpForo Forum to version 2.0.6 or newer.
- Official ID
- CVE-2022-40206
- Report title
- wpForo Forum <= 2.0.5 - Insecure Direct Object Reference to Forum Privacy Change
- First reported
- Sources
- Wordfence, seen
Anyone with an account on your site, even a basic one could run their own code on your site and take it over
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 2.0.9
- Fixed in
- 2.1.0
- What to do
- If your site has an affected version, update wpForo Forum to version 2.1.0 or newer.
- Official ID
- CVE-2022-40200
- Report title
- wpForo Forum <= 2.0.9 - Authenticated (Subscriber+) Arbitrary File Upload
- First reported
- Sources
- Wordfence, seen
Someone could trick a logged-in admin into changing settings without knowing (up to and including 2.0.9)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 2.0.9
- Fixed in
- 2.1.0
- What to do
- If your site has an affected version, update wpForo Forum to version 2.1.0 or newer.
- Official ID
- CVE-2022-40192
- Report title
- wpForo Forum <= 2.0.9 - Cross-Site Request Forgery
- First reported
- Sources
- Wordfence, seen
Someone could use it to harm your site (up to and including 2.0.5) (2)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 2.0.5
- Fixed in
- 2.0.6
- What to do
- If your site has an affected version, update wpForo Forum to version 2.0.6 or newer.
- Official ID
- CVE-2022-40205
- Report title
- wpForo Forum <= 2.0.5 - Insecure Direct Object Reference to Forum Status Change
- First reported
- Sources
- Wordfence, seen
Someone could trick a logged-in admin into changing settings without knowing (up to and including 2.0.5)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 2.0.5
- Fixed in
- 2.0.6
- What to do
- If your site has an affected version, update wpForo Forum to version 2.0.6 or newer.
- Official ID
- CVE-2022-38144
- Report title
- wpForo Forum <= 2.0.5 - Cross-Site Request Forgery
- First reported
- Sources
- Wordfence, seen
Someone could trick a logged-in admin into changing settings without knowing (up to and including 2.0.5) (2)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 2.0.5
- Fixed in
- 2.0.6
- What to do
- If your site has an affected version, update wpForo Forum to version 2.0.6 or newer.
- Official ID
- CVE-2022-40632
- Report title
- wpForo Forum <= 2.0.5 - Cross-Site Request Forgery
- First reported
- Sources
- Wordfence, seen
Someone could send your visitors from your site to a harmful site
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 1.9.6
- Fixed in
- 1.9.7
- What to do
- If your site has an affected version, update wpForo Forum to version 1.9.7 or newer.
- Official ID
- CVE-2021-24406
- Report title
- wpForo Forum <= 1.9.6 - Open Redirect
- First reported
- Sources
- Wordfence, seen
Someone could plant harmful code that runs for your visitors or admins (up to and including 1.6.5)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 1.6.5
- Fixed in
- 1.7.0
- What to do
- If your site has an affected version, update wpForo Forum to version 1.7.0 or newer.
- Official ID
- CVE-2019-19111
- Report title
- wpForo Forum <= 1.6.5 - Cross-Site Scripting via langid parameter
- First reported
- Sources
- Wordfence, seen
Someone could trick a logged-in admin into changing settings without knowing (up to and including 1.6.5)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 1.6.5
- Fixed in
- 1.7.0
- What to do
- If your site has an affected version, update wpForo Forum to version 1.7.0 or newer.
- Official ID
- CVE-2019-19109
- Report title
- wpForo Forum <= 1.6.5 - Cross-Site Request Forgery
- First reported
- Sources
- Wordfence, seen
Someone could plant harmful code that runs for your visitors or admins (up to and including 1.6.5) (2)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 1.6.5
- Fixed in
- 1.7.0
- What to do
- If your site has an affected version, update wpForo Forum to version 1.7.0 or newer.
- Official ID
- CVE-2019-19112
- Report title
- wpForo Forum <= 1.6.5 - Cross-Site Scripting via wpf-dw-td-value class
- First reported
- Sources
- Wordfence, seen
Someone could plant harmful code that runs for your visitors or admins (up to and including 1.6.5) (3)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 1.6.5
- Fixed in
- 1.7.0
- What to do
- If your site has an affected version, update wpForo Forum to version 1.7.0 or newer.
- Official ID
- CVE-2019-19110
- Report title
- wpForo Forum <= 1.6.5 - Cross-Site Scripting via s parameter
- First reported
- Sources
- Wordfence, seen
Someone could take over your site as an admin
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 1.5.1
- Fixed in
- 1.5.2
- What to do
- If your site has an affected version, update wpForo Forum to version 1.5.2 or newer.
- Official ID
- CVE-2018-16613
- Report title
- wpForo < = 1.5.1 - Privilege Escalation
- First reported
- Sources
- Wordfence, seen
Someone could plant harmful code that runs for your visitors or admins (before 1.4.12)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Before 1.4.12
- Fixed in
- 1.4.12
- What to do
- If your site has an affected version, update wpForo Forum to version 1.4.12 or newer.
- Official ID
- CVE-2018-11709
- Report title
- wpForo Forum < 1.4.12 - Reflected Cross-Site Scripting
- First reported
- Sources
- Wordfence, seen
Someone could read or change the data in your site’s database (up to and including 1.4.12)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 1.4.12
- Fixed in
- 1.4.13
- What to do
- If your site has an affected version, update wpForo Forum to version 1.4.13 or newer.
- Official ID
- CVE-2018-11515
- Report title
- wpForo Forum <= 1.4.12 - SQL Injection
- First reported
- Sources
- Wordfence, seen
Where this comes from
We collect these reports from public security sources and rewrite them in plain words. Each problem shows its sources and the date we first saw it. This page never says whether your own site is affected: only a check of your site’s versions can tell.
Get an email when your site is affected.
Install Watchfox AI once. It checks your plugins and themes against this list every day, for free.
Install Watchfox AI (free)