487 matches found
CVE-2021-24406
The wpForo Forum WordPress plugin before 1.9.7 did not validate the redirectto parameter in the login form of the forum, leading to an open redirect issue after a successful login. Such issue could allow an attacker to induce a user to use a login URL redirecting to a website under their control...
CVE-2018-11709
wpforogetrequesturi in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected Cross-Site Scripting XSS via the URI...
CVE-2018-16613
An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress. A registered forum is able to escalate privilege to the forum administrator without any form of user interaction...
CVE-2025-31420
Incorrect Privilege Assignment vulnerability in Tomdever wpForo Forum wpforo allows Privilege Escalation.This issue affects wpForo Forum: from n/a through = 2.4.2...
CVE-2025-31420
Incorrect Privilege Assignment vulnerability in Tomdever wpForo Forum wpforo allows Privilege Escalation.This issue affects wpForo Forum: from n/a through = 2.4.2...
CVE-2025-31420 WordPress wpForo Forum plugin <= 2.4.2 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in Tomdever wpForo Forum wpforo allows Privilege Escalation.This issue affects wpForo Forum: from n/a through = 2.4.2...
CVE-2025-31420
wpForo Forum (WordPress) has an authenticated Privilege Escalation vulnerability (CVE-2025-31420) due to Incorrect Privilege Assignment. Affected versions are wpForo Forum <= 2.4.3; Patch status in connected sources shows this was patched in 2.4.3. The linked Wordfence entry explicitly lists w...
CVE-2025-31420 WordPress wpForo Forum plugin <= 2.4.2 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in Tomdever wpForo Forum wpforo allows Privilege Escalation.This issue affects wpForo Forum: from n/a through = 2.4.2...
PT-2025-14886 · WordPress · Wpforo Forum
Name of the Vulnerable Software and Affected Versions: wpForo Forum versions 2.4.2 and earlier Description: The issue is related to an Incorrect Privilege Assignment, which allows Privilege Escalation in the wpForo Forum. Recommendations: For versions 2.4.2 and earlier, update to a version that...
WordPress plugin wpForo Forum 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
WordPress wpForo Forum plugin <= 2.4.2 - Privilege Escalation vulnerability
Privilege Escalation vulnerability discovered by Revan Arifio Patchstack Alliance in WordPress Plugin wpForo Forum versions = 2.4.2...
CVE-2025-0764
The wpForo Forum plugin for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'update' method of the 'Members' class in all versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with subscriber-level privileges or higher...
CVE-2025-0764 wpForo Forum <= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in update
The wpForo Forum plugin for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'update' method of the 'Members' class in all versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with subscriber-level privileges or higher...
CVE-2025-0764
CVE-2025-0764 (wpForo Forum for WordPress) is an authenticated (Subscriber+) arbitrary file read vulnerability in the update() method of the Members class, affecting all versions up to 2.4.1. Exploitation allows reading server files with low privileges. Remediation: upgrade to wpForo Forum 2.4.2 ...
CVE-2025-0764 wpForo Forum <= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in update
The wpForo Forum plugin for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'update' method of the 'Members' class in all versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with subscriber-level privileges or higher...
WordPress plugin wpForo Forum 输入验证错误漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An input validation error...
WordPress wpForo Forum plugin <= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in update vulnerability
Authenticated Subscriber+ Arbitrary File Read in update vulnerability discovered by mikemyers in WordPress Plugin wpForo Forum versions = 2.4.1...
CVE-2024-43289
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in gVectors Team wpForo Forum.This issue affects wpForo Forum: from n/a through 2.3.4...
CVE-2024-3200
The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'slug' attribute of the 'wpforo' shortcode in all versions up to, and including, 2.3.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes ...
CVE-2023-47869
Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in gVectors Team wpForo Forum allows Code Injection.This issue affects wpForo Forum: from n/a through 2.2.5...