Extension WordPress
Vulnérabilités wpForo Forum, page 3
Cette page rassemble les failles publiées pour wpForo Forum, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de wpForo Forum
49 fiches
wpForo Forum <= 2.0.5 – Cross-Site Request Forgery
The wpForo Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.5. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for…
*-2.0.5
2.0.6
08/09/2022
wpForo Forum <= 1.9.6 – Open Redirect
The wpForo Forum WordPress plugin before 1.9.7 did not validate the redirect_to parameter in the login form of the forum, leading to an open redirect issue after a successful login. Such issue could allow an attacker to induce…
*-1.9.6
1.9.7
14/06/2021
wpForo Forum <= 1.6.5 – Cross-Site Scripting via s parameter
The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter.
*-1.6.5
1.7.0
04/05/2020
wpForo Forum <= 1.6.5 – Cross-Site Scripting via wpf-dw-td-value class
The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php.
*-1.6.5
1.7.0
04/05/2020
wpForo Forum <= 1.6.5 – Cross-Site Request Forgery
The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF.
*-1.6.5
1.7.0
04/05/2020
wpForo Forum <= 1.6.5 – Cross-Site Scripting via langid parameter
The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter.
*-1.6.5
1.7.0
04/05/2020
wpForo < = 1.5.1 – Privilege Escalation
An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress. A registered forum user is able to escalate privilege to the forum administrator without any form of user interaction.
*-1.5.1
1.5.2
06/09/2018
wpForo Forum < 1.4.12 – Reflected Cross-Site Scripting
wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected Cross-Site Scripting (XSS) via the URI.
[*, 1.4.12)
1.4.12
01/06/2018
wpForo Forum <= 1.4.12 – SQL Injection
The wpForo Forum plugin for WordPress is vulnerable to Blind SQL Injection via the ‘wpfo’ parameter in versions up to, and including, 1.4.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on…
*-1.4.12
1.4.13
27/05/2018
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.