wpForo < 1.7.0 - Reflected Cross-Site Scripting (XSS) via s Parameter

The plugin did not escape, validate or escape the 's' GET parameter before outputting back in the page, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in admin PoC https://example.com/wp-admin/admin.php?page=wpforo-phrases="...

wpForo < 1.7.0 - Reflected Cross-Site Scripting (XSS) via s Parameter

The plugin did not escape, validate or escape the 's' GET parameter before outputting back in the page, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in admin https://example.com/wp-admin/admin.php?page=wpforo-phrases&s="alert/XSS/...

WordPress wpForo Forum Plugin Privilege Vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. wpForo Forum plugin is a forum plugin used in it. WordPress wpForo Forum plugin version 1.5.2 before the existence of a...

WordPress wpForo Forum Plugin < 1.5.2 Privilege Escalation Vulnerability

The WordPress plugin Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

CVE-2018-16613

An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress. A registered forum is able to escalate privilege to the forum administrator without any form of user interaction...

CVE-2018-16613

An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress. A registered forum is able to escalate privilege to the forum administrator without any form of user interaction...

CVE-2018-16613

The CVE-2018-16613 entry concerns the wpForo Forum WordPress plugin (versions prior to 1.5.2). The vulnerability stems from the update function, allowing a registered forum user to escalate privileges to the forum administrator without any user interaction. Documented impact aligns with a high/cr...

PT-2019-9356

Name of the Vulnerable Software and Affected Versions wpForo Forum plugin versions prior to 1.5.2 Description A privilege escalation issue was discovered in the update function of the wpForo Forum plugin. This allows a registered forum user to escalate their privileges to those of a forum...

CVE-2018-16613: Undefined Security Weakness

An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress. A registered forum is able to escalate privilege to the forum administrator without any form of user interaction...

wpForo < 1.5.2 - Privilege Escalation

The wpForo Forum WordPress plugin was affected by a Privilege Escalation security vulnerability...

WordPress wpForo Forum plugin <= 1.4.11 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability

Unauthenticated Reflected Cross-Site Scripting XSS vulnerability found by Ryan Dewhurst Security in WordPress wpForo Forum plugin versions = 1.4.11. Solution Update the WordPress wpForo Forum plugin to the latest available version at least 1.4.12...

WordPress wpForo Forum plugin <= 1.4.9 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability found by cate4cafe in WordPress wpForo Forum plugin versions = 1.4.9. Solution Update the WordPress wpForo Forum plugin to the latest available version at least 1.4.11...

wpForo Forum Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site. wpForo Forum plugin is used in one of the forum plugin . WordPress wpForo Forum plugin version 1.4.12 before the...

CVE-2018-11709

wpforogetrequesturi in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected Cross-Site Scripting XSS via the URI...

CVE-2018-11709

wpforogetrequesturi in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected Cross-Site Scripting XSS via the URI...

CVE-2018-11709

wpforogetrequesturi in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected Cross-Site Scripting XSS via the URI...

CVE-2018-11709

Summary: CVE-2018-11709 affects the WordPress WordPress wpForo Forum plugin (versions

CVE-2018-11709: Improper Neutralization of Input During Web Page Generation

wpforogetrequesturi in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected Cross-Site Scripting XSS via the URI...

PT-2018-10767

Name of the Vulnerable Software and Affected Versions wpForo Forum plugin versions prior to 1.4.12 Description The issue allows Unauthenticated Reflected Cross-Site Scripting XSS via the URI. This is due to the wpforo get request uri function in wpf-includes/functions.php. Recommendations For...

wpForo Forum <= 1.4.11 - Unauthenticated Reflected Cross-Site Scripting (XSS)

Version 1.4.11, and below, of the wpForo Forum WordPress Plugin were found to be vulnerable to Reflected Cross-Site Scripting XSS. The vulnerability was due to the Plugin using the $SERVER'REQUESTURI' PHP variable to create a URL string that was later output within HTML without any output encodin...