CVE-2019-19109

The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF...

CVE-2019-19111

The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter...

CVE-2019-19112

The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php...

CVE-2019-19110

The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter...

Design/Logic Flaw

The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php...

Design/Logic Flaw

The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter...

Cross site request forgery (csrf)

The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF...

Design/Logic Flaw

The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter...

CVE-2019-19111

The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter...

CVE-2019-19111

CVE-2019-19111 affects the WordPress wpForo Forum plugin version 1.6.5. The vulnerability is a reflected XSS arising from improper handling of the langid parameter in the admin page (wp-admin/admin.php?page=wpforo-phrases). The root cause is lack of proper validation/escaping of client-supplied d...

CVE-2019-19110

The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter...

CVE-2019-19110

CVE-2019-19110 affects WordPress wpForo Forum plugin version 1.6.5, where a reflected XSS can be triggered via the admin page parameter wp-admin/admin.php?page=wpforo-phrases. The root cause cited across sources is lack of proper validation/escaping of the s parameter, enabling execution of clien...

CVE-2019-19109

CVE-2019-19109 affects the WordPress wpForo Forum plugin version 1.6.5. The vulnerability is a cross-site request forgery (CSRF) in wp-admin/admin.php?page=wpforo-usergroups, enabling an attacker to trigger privileged actions by convincing an authenticated admin. Connected sources corroborate the...

CVE-2019-19109

The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF...

CVE-2019-19112

The CVE-2019-19112 entry applies to the WordPress wpForo Forum plugin version 1.6.5 and describes a cross-site scripting (XSS) issue in the dashboard.php file via the wpf-dw-td-value class. The vulnerability is rooted in insufficient input/data validation, enabling an attacker to inject and execu...

CVE-2019-19112

The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php...

wpForo < 1.7.0 - New Users Set as Admin via CSRF

The plugin did not have CSRF in place in a page, allowing attacker to make a logged in admin set all new users as admins directly PoC https://example.com/wp-admin/admin.php?page=wpforo-usergroups=1...

wpForo < 1.7.0 - Reflected Cross-Site Scripting (XSS) via User Agent

The plugin did not escape, validate or escape the User Agent header before outputting back in the page, leading to a reflected Cross-Site Scripting issue...

wpForo < 1.7.0 - Reflected Cross-Site Scripting (XSS) via s Parameter

The plugin did not escape, validate or escape the 's' GET parameter before outputting back in the page, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in admin PoC https://example.com/wp-admin/admin.php?page=wpforo-phrases="...

wpForo < 1.7.0 - Reflected Cross-Site Scripting (XSS) via s Parameter

The plugin did not escape, validate or escape the 's' GET parameter before outputting back in the page, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in admin https://example.com/wp-admin/admin.php?page=wpforo-phrases&s="alert/XSS/...