Asgaros Forum < 3.2.0 - SQL Injection

Asgaros Forum for WordPress versions prior to 3.2.0 is vulnerable to unauthenticated SQL injection through the asgarosforumunreadexclude cookie. The cookie is JSON-decoded and its object keys are imploded into a NOT IN clause without sanitisation. The vulnerable query only runs while rendering th...

CVE-2025-11452: Improper Neutralization of Special Elements used in an SQL Command

The Asgaros Forum plugin for WordPress is vulnerable to SQL Injection via the '$COOKIE'asgarosforumunreadexclude'' cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...