473 matches found
wpForo Forum <= 2.4.14 - SQL Injection
wpForo Forum WordPress plugin = 2.4.14 contains a time-based SQL injection caused by insufficient escaping of the 'wpfob' parameter, letting unauthenticated attackers extract sensitive database information. id: CVE-2026-1581 info: name: wpForo Forum = 2.4.14 - SQL Injection author: Shivam Kamboj...
wpForo Forum <= 2.1.8 - Cross-Site Scripting
The wpForo Forum plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wpforodebug’ function in versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
WordPress wpForo Forum < 1.9.7 - Open Redirect
WordPress wpForo Forum 1.9.7 is susceptible to an open redirect vulnerability because the plugin did not validate the redirectto parameter in the login form of the forum, leading to an open redirect issue after a successful login. id: CVE-2021-24406 info: name: WordPress wpForo Forum 1.9.7 - Open...
CVE-2026-1581-Analysis-Lab
CVE-2026-1581 — wpForo Forum GET'wpfob' → wpforosanitizeorderby..., context, default Behav...
VulnCheck KEV: CVE-2026-119155
The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'hreflocale' parameter in all versions up to, and including, 3.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...
CVE-2026-95870
The wpForo Forum plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to, and including, 3.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
CVE-2026-120532
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postbody' parameter in all versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access...
CVE-2026-119155
The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'hreflocale' parameter in all versions up to, and including, 3.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...
CVE-2026-119164
The wpForo Forum plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.2 via the datasecondarygroupids parameter of the wpforoactionprofileupdate POST handler. This is due to a type-confusion flaw in the secondarygroupids authorization guard within t...
CVE-2026-110004
The wpForo Forum plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the themedelete function in all versions up to, and including, 3.2.2 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete...
CVE-2026-120532
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.2.2 . The root cause is insufficient input sanitization and output escaping of the 'post[body]' parameter within moderation forms. This allows authenticated attackers with su...
CVE-2026-120532 wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Reply Body in Moderation Forms
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postbody' parameter in all versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access...
EUVD-2026-119039
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postbody' parameter in all versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access...
CVE-2026-119164
The wpForo Forum plugin for WordPress (versions
EUVD-2026-119037
The wpForo Forum plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.2 via the datasecondarygroupids parameter of the wpforoactionprofileupdate POST handler. This is due to a type-confusion flaw in the secondarygroupids authorization guard within t...
CVE-2026-119164 wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Privilege Escalation to 'data[secondary_groupids]' CSV Parameter
The wpForo Forum plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.2 via the datasecondarygroupids parameter of the wpforoactionprofileupdate POST handler. This is due to a type-confusion flaw in the secondarygroupids authorization guard within t...
CVE-2026-95870
The wpForo Forum plugin for WordPress (versions
CVE-2026-95870 wpForo Forum <= 3.2.1 - Unauthenticated SQL Injection via 'data' Parameter
The wpForo Forum plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to, and including, 3.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
EUVD-2026-119038
The wpForo Forum plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to, and including, 3.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
CVE-2026-119155 wpForo Forum <= 3.2.2 - Unauthenticated SQL Injection via 'href[locale]' Parameter
The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'hreflocale' parameter in all versions up to, and including, 3.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...