Extension WordPress
Vulnérabilités wpForo Forum, page 2
Cette page rassemble les failles publiées pour wpForo Forum, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de wpForo Forum
49 fiches
wpForo Forum <= 2.4.8 – Unauthenticated SQL Injection via get_members Function
The wpForo Forum plugin for WordPress is vulnerable to error‐based or time-based SQL Injection via the get_members() function in all versions up to, and including, 2.4.8 due to missing integer validation on the 'offset' and 'row_count' parameters. The…
*-2.4.8
2.4.9
24/10/2025
wpForo Forum <= 2.4.6 – Authenticated (Subscriber+) Insecure Direct Object Reference
The wpForo Forum plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.6 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with…
*-2.4.6
2.4.7
03/09/2025
wpForo Forum <= 2.4.5 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
*-2.4.5
2.4.6
09/07/2025
wpForo Forum <= 2.4.3 – Authenticated (Subscriber+) Privilege Escalation
The wpForo Forum plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges.
*-2.4.3
2.4.4
02/04/2025
wpForo Forum <= 2.4.1 – Authenticated (Subscriber+) Arbitrary File Read in update
The wpForo Forum plugin for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'update' method of the 'Members' class in all versions up to, and including, 2.4.1. This makes it possible for…
*-2.4.1
2.4.2
27/02/2025
wpForo Forum <= 2.3.4 – Authenticated (Subscriber+) Insecure Direct Object Reference
The wpForo Forum plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.3.4 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with…
*-2.3.4
2.3.5
16/08/2024
wpForo Forum <= 2.3.4 – Unauthenticated Sensitive Information Exposure
The wpForo Forum plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.4. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.
*-2.3.4
2.3.5
16/08/2024
wpForo Forum <= 2.3.3 – Authenticated (Contributor+) SQL Injection
The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'slug' attribute of the 'wpforo' shortcode in all versions up to, and including, 2.3.3 due to insufficient escaping on the user supplied parameter and lack…
*-2.3.3
2.3.4
31/05/2024
wpForo Forum <= 2.2.8 – Cross-Site Request Forgery via logout()
The wpForo Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.2.8. This is due to missing or incorrect nonce validation on the logout() function. This makes it possible for unauthenticated…
*-2.2.8
2.2.9
20/11/2023
wpForo Forum <= 2.2.5 – Missing Authorization
The wpForo Forum plugin for WordPress is vulnerable to unauthorized control of data due to a missing capability check on an unknown function in all versions up to, and including, 2.2.5. This makes it possible for authenticated attackers,…
*-2.2.5
2.2.6
20/11/2023
wpForo Forum <= 2.2.3 – Unauthenticated Privilege Escalation
The wpForo Forum plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.2.3. This is due to incorrect assignment of user permissions during registration. This makes it possible for unauthenticated attackers to…
*-2.2.3
2.2.4
20/11/2023
wpForo Forum <= 2.2.3 – Authenticated (Subscriber+) Stored Cross-Site Scripting
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and…
*-2.2.3
2.2.4
20/11/2023
wpForo Forum <= 2.1.8 – Reflected Cross-Site Scripting via 'wpforo_debug'
The wpForo Forum plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wpforo_debug’ function in versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers…
*-2.1.8
2.1.9
03/07/2023
wpForo Forum <= 2.1.7 – Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents
The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deserialization in versions up to, and including, 2.1.7. This is due to the insecure use of file_get_contents without appropriate verification of…
*-2.1.7
2.1.8
01/06/2023
wpForo Forum <= 2.0.9 – Authenticated (Subscriber+) HTML Injection
The wpForo Forum plugin for WordPress is vulnerable to HTML Injection in versions up to, and including, 2.0.9. This is due to insufficient escaping and sanitization of user supplied input. This makes it possible for authenticated attackers, with…
*-2.0.9
2.1.0
07/12/2022
wpForo Forum <= 2.0.5 – Insecure Direct Object Reference to Forum Privacy Change
The wpForo Forum plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.5. This makes it possible for authenticated attackers, with subscriber-level access or higher, to mark any forum post as…
*-2.0.5
2.0.6
26/11/2022
wpForo Forum <= 2.0.9 – Cross-Site Request Forgery
The wpForo Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.9. This is due to missing or incorrect nonce validation on the profile_cover_delete function. This makes it possible for unauthenticated…
*-2.0.9
2.1.0
09/11/2022
wpForo Forum <= 2.0.9 – Authenticated (Subscriber+) Arbitrary File Upload
The wpForo Forum plugin for WordPress is vulnerable to arbitrary file uploads due to missing protections or file validations in versions up to, and including, 2.0.9. This makes it possible for authenticated attackers, with minimal permissions, to upload…
*-2.0.9
2.1.0
09/11/2022
wpForo Forum <= 2.0.5 – Insecure Direct Object Reference to Forum Status Change
The wpForo Forum plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.5. This makes it possible for authenticated attackers, with subscriber-level access or higher, to mark any forum post as…
*-2.0.5
2.0.6
26/09/2022
wpForo Forum <= 2.0.5 – Cross-Site Request Forgery
The wpForo Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.5. This is due to missing or incorrect nonce validation on various AJAX actions. This makes it possible for unauthenticated…
*-2.0.5
2.0.6
08/09/2022
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.