CVE-2019-19111

CVE-2019-19111 affects the WordPress wpForo Forum plugin version 1.6.5. The vulnerability is a reflected XSS arising from improper handling of the langid parameter in the admin page (wp-admin/admin.php?page=wpforo-phrases). The root cause is lack of proper validation/escaping of client-supplied d...

CVE-2018-11515

The CVE-2018-11515 entry concerns the WordPress wpForo Forum plugin. Affected versions are

CVE-2019-19110

CVE-2019-19110 affects WordPress wpForo Forum plugin version 1.6.5, where a reflected XSS can be triggered via the admin page parameter wp-admin/admin.php?page=wpforo-phrases. The root cause cited across sources is lack of proper validation/escaping of the s parameter, enabling execution of clien...

CVE-2019-19109

CVE-2019-19109 affects the WordPress wpForo Forum plugin version 1.6.5. The vulnerability is a cross-site request forgery (CSRF) in wp-admin/admin.php?page=wpforo-usergroups, enabling an attacker to trigger privileged actions by convincing an authenticated admin. Connected sources corroborate the...

CVE-2019-19112

The CVE-2019-19112 entry applies to the WordPress wpForo Forum plugin version 1.6.5 and describes a cross-site scripting (XSS) issue in the dashboard.php file via the wpf-dw-td-value class. The vulnerability is rooted in insufficient input/data validation, enabling an attacker to inject and execu...