CVE-2019-19111

CVE-2019-19111 affects the WordPress wpForo Forum plugin version 1.6.5. The vulnerability is a reflected XSS arising from improper handling of the langid parameter in the admin page (wp-admin/admin.php?page=wpforo-phrases). The root cause is lack of proper validation/escaping of client-supplied d...

CVE-2019-19110

The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter...

CVE-2019-19110

CVE-2019-19110 affects WordPress wpForo Forum plugin version 1.6.5, where a reflected XSS can be triggered via the admin page parameter wp-admin/admin.php?page=wpforo-phrases. The root cause cited across sources is lack of proper validation/escaping of the s parameter, enabling execution of clien...

CVE-2019-19109

The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF...

CVE-2019-19109

CVE-2019-19109 affects the WordPress wpForo Forum plugin version 1.6.5. The vulnerability is a cross-site request forgery (CSRF) in wp-admin/admin.php?page=wpforo-usergroups, enabling an attacker to trigger privileged actions by convincing an authenticated admin. Connected sources corroborate the...

CVE-2019-19112

The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php...

CVE-2019-19112

The CVE-2019-19112 entry applies to the WordPress wpForo Forum plugin version 1.6.5 and describes a cross-site scripting (XSS) issue in the dashboard.php file via the wpf-dw-td-value class. The vulnerability is rooted in insufficient input/data validation, enabling an attacker to inject and execu...

PT-2020-10051

Name of the Vulnerable Software and Affected Versions wpForo plugin version 1.6.5 Description The issue concerns a CSRF vulnerability in the wpForo plugin for WordPress. It affects the "wp-admin/admin.php?page=wpforo-usergroups" endpoint. There is no information provided about the estimated numbe...

PT-2020-10054

Name of the Vulnerable Software and Affected Versions wpForo plugin version 1.6.5 Description The issue involves a Cross-Site Scripting XSS vulnerability. It is related to the wpf-dw-td-value class in the dashboard.php file. Recommendations For wpForo plugin version 1.6.5, consider disabling the...

PT-2020-10053

Name of the Vulnerable Software and Affected Versions wpForo plugin version 1.6.5 Description The issue allows for XSS via the "wp-admin/admin.php?page=wpforo-phrases" API endpoint, specifically through the langid parameter. Recommendations For wpForo plugin version 1.6.5, avoid using the langid...

PT-2020-10052

Name of the Vulnerable Software and Affected Versions wpForo plugin version 1.6.5 Description The issue allows for XSS via the "s" parameter in the "/admin.php?page=wpforo-phrases" API endpoint. Recommendations For wpForo plugin version 1.6.5, avoid using the s parameter in the...

CVE-2019-19109: Cross-Site Request Forgery (CSRF)

The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF...

CVE-2019-19112: Improper Neutralization of Input During Web Page Generation

The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php...

CVE-2019-19111: Improper Neutralization of Input During Web Page Generation

The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter...

CVE-2019-19110: Improper Neutralization of Input During Web Page Generation

The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter...

wpForo < 1.7.0 - New Users Set as Admin via CSRF

The plugin did not have CSRF in place in a page, allowing attacker to make a logged in admin set all new users as admins directly https://example.com/wp-admin/admin.php?page=wpforo-usergroups&default=1...

wpForo < 1.7.0 - New Users Set as Admin via CSRF

The plugin did not have CSRF in place in a page, allowing attacker to make a logged in admin set all new users as admins directly PoC https://example.com/wp-admin/admin.php?page=wpforo-usergroups=1...

wpForo < 1.7.0 - Reflected Cross-Site Scripting (XSS) via langid Parameter

The plugin did not escape, validate or escape the 'langid' GET parameter before outputting back in the page, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in admin...

wpForo < 1.7.0 - Reflected Cross-Site Scripting (XSS) via langid Parameter

The plugin did not escape, validate or escape the 'langid' GET parameter before outputting back in the page, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in admin PoC...

wpForo < 1.7.0 - Reflected Cross-Site Scripting (XSS) via User Agent

The plugin did not escape, validate or escape the User Agent header before outputting back in the page, leading to a reflected Cross-Site Scripting issue...