CVE-2019-19109

CVE-2019-19109 affects the WordPress wpForo Forum plugin version 1.6.5. The vulnerability is a cross-site request forgery (CSRF) in wp-admin/admin.php?page=wpforo-usergroups, enabling an attacker to trigger privileged actions by convincing an authenticated admin. Connected sources corroborate the...

CVE-2019-19109

The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF...

CVE-2019-19112

The CVE-2019-19112 entry applies to the WordPress wpForo Forum plugin version 1.6.5 and describes a cross-site scripting (XSS) issue in the dashboard.php file via the wpf-dw-td-value class. The vulnerability is rooted in insufficient input/data validation, enabling an attacker to inject and execu...

CVE-2019-19112

The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php...

CVE-2019-19109: Cross-Site Request Forgery (CSRF)

The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF...

CVE-2019-19111: Improper Neutralization of Input During Web Page Generation

The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter...

CVE-2019-19110: Improper Neutralization of Input During Web Page Generation

The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter...

CVE-2019-19112: Improper Neutralization of Input During Web Page Generation

The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php...

wpForo < 1.7.0 - Reflected Cross-Site Scripting (XSS) via User Agent

The plugin did not escape, validate or escape the User Agent header before outputting back in the page, leading to a reflected Cross-Site Scripting issue...

wpForo < 1.7.0 - New Users Set as Admin via CSRF

The plugin did not have CSRF in place in a page, allowing attacker to make a logged in admin set all new users as admins directly PoC https://example.com/wp-admin/admin.php?page=wpforo-usergroups=1...

wpForo < 1.7.0 - Reflected Cross-Site Scripting (XSS) via s Parameter

The plugin did not escape, validate or escape the 's' GET parameter before outputting back in the page, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in admin PoC https://example.com/wp-admin/admin.php?page=wpforo-phrases="...

wpForo < 1.7.0 - Reflected Cross-Site Scripting (XSS) via s Parameter

The plugin did not escape, validate or escape the 's' GET parameter before outputting back in the page, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in admin https://example.com/wp-admin/admin.php?page=wpforo-phrases&s="alert/XSS/...

wpForo < 1.7.0 - New Users Set as Admin via CSRF

The plugin did not have CSRF in place in a page, allowing attacker to make a logged in admin set all new users as admins directly https://example.com/wp-admin/admin.php?page=wpforo-usergroups&default=1...

wpForo < 1.7.0 - Reflected Cross-Site Scripting (XSS) via langid Parameter

The plugin did not escape, validate or escape the 'langid' GET parameter before outputting back in the page, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in admin PoC...

wpForo < 1.7.0 - Reflected Cross-Site Scripting (XSS) via langid Parameter

The plugin did not escape, validate or escape the 'langid' GET parameter before outputting back in the page, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in admin...

WordPress wpForo Forum Plugin Privilege Vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. wpForo Forum plugin is a forum plugin used in it. WordPress wpForo Forum plugin version 1.5.2 before the existence of a...

WordPress wpForo Forum Plugin < 1.5.2 Privilege Escalation Vulnerability

The WordPress plugin Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

CVE-2018-16613

An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress. A registered forum is able to escalate privilege to the forum administrator without any form of user interaction...

CVE-2018-16613

An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress. A registered forum is able to escalate privilege to the forum administrator without any form of user interaction...

CVE-2018-16613

The CVE-2018-16613 entry concerns the wpForo Forum WordPress plugin (versions prior to 1.5.2). The vulnerability stems from the update function, allowing a registered forum user to escalate privileges to the forum administrator without any user interaction. Documented impact aligns with a high/cr...