Advisories · Technology

tomdever wpForo Forum.

Every CVE that names tomdever wpForo Forum among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-93747 CVE record

CVSS 6.4 Medium

wpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field
- tomdever wpForo Forum
- Cross-site scripting (XSS)
Not analysed yet 25 Sept 2026
CVE-2026-93772 CVE record

CVSS 6.5 Medium

WordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability
- Tomdever wpForo Forum
- Cross-site scripting (XSS)
Not analysed yet 23 Sept 2026
CVE-2026-91092 CVE record

CVSS 4.3 Medium

wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie
- tomdever wpForo Forum
- Broken access control
Not analysed yet 22 Sept 2026
CVE-2026-5097 CVE record

CVSS 7.5 High

wpForo Forum <= 2.4.17 - Unauthenticated SQL Injection via 'referer' Parameter
- tomdever wpForo Forum
- SQL injection
Not analysed yet 28 Aug 2026
CVE-2026-15021 CVE record

CVSS 6.4 Medium

wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field
- tomdever wpForo Forum
- Cross-site scripting (XSS)
Not analysed yet 16 Jul 2026
CVE-2026-57636 CVE record

CVSS 8.5 High

WordPress wpForo Forum plugin <= 3.0.9 - SQL Injection vulnerability
- Tomdever wpForo Forum
- SQL injection
Not analysed yet 26 Jun 2026
CVE-2026-49767 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress wpForo Forum plugin <= 3.1.0 - Broken Authentication vulnerability
- Tomdever wpForo Forum
- Authentication bypass
Not analysed yet 17 Jun 2026
CVE-2026-49769 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress wpForo Forum plugin <= 3.1.0 - PHP Object Injection vulnerability
- Tomdever wpForo Forum
- Insecure deserialization
Not analysed yet 15 Jun 2026
CVE-2026-40798 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress wpForo Forum plugin <= 3.0.4 - SQL Injection vulnerability
- Tomdever wpForo Forum
- SQL injection
Not analysed yet 15 Jun 2026
CVE-2026-40767 CVE record

CVSS 7.5 High

WordPress wpForo Forum plugin < 3.0.2 - Broken Access Control vulnerability
- Tomdever wpForo Forum
- CWE-281
Not analysed yet 15 Jun 2026
CVE-2026-42682 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

WordPress wpForo Forum plugin <= 3.0.6 - Broken Access Control vulnerability
- Tomdever wpForo Forum
- Broken access control
Not analysed yet 1 Jun 2026
CVE-2026-6248 CVE record

CVSS 8.1 High

wpForo Forum <= 3.0.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Custom Profile Field File Path
- tomdever wpForo Forum
- Path traversal
Not analysed yet 20 Apr 2026
CVE-2026-4666 CVE record

CVSS 6.5 Medium

wpForo Forum <= 2.4.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter
- tomdever wpForo Forum
- Broken access control
Not analysed yet 17 Apr 2026
CVE-2026-5809 CVE record

CVSS 7.1 High

wpForo Forum <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter
- tomdever wpForo Forum
- Path traversal
Not analysed yet 11 Apr 2026
CVE-2026-3666 CVE record

CVSS 8.8 High

wpForo Forum <= 2.4.16 - Authenticated (Subscriber+) Arbitrary File Deletion via Post Body
- tomdever wpForo Forum
- Path traversal
Not analysed yet 4 Apr 2026
CVE-2026-1581 CVE record

CVSS 7.5 High

wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection
- tomdever wpForo Forum
- SQL injection
Not analysed yet 19 Feb 2026
CVE-2026-0910 CVE record

CVSS 8.8 High

wpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection
- tomdever wpForo Forum
- Insecure deserialization
Not analysed yet 11 Feb 2026
CVE-2025-66070 CVE record

CVSS 7.5 High

WordPress wpForo Forum plugin <= 2.4.10 - Broken Access Control vulnerability
- Tomdever wpForo Forum
- Broken access control
Not analysed yet 18 Dec 2025
CVE-2025-13126 CVE record

CVSS 7.5 High

wpForo Forum <= 2.4.12 - Unauthenticated SQL Injection
- tomdever wpForo Forum
- SQL injection
Not analysed yet 14 Dec 2025
CVE-2025-11740 CVE record

CVSS 6.5 Medium

wpForo Forum <= 2.4.9 - Authenticated (Susbscriber+) SQL Injection
- tomdever wpForo Forum
- SQL injection
Not analysed yet 1 Nov 2025
CVE-2025-4203 CVE record

CVSS 7.5 High

wpForo Forum <= 2.4.8 - Unauthenticated SQL Injection via get_members Function
- tomdever wpForo Forum
- SQL injection
Not analysed yet 25 Oct 2025
CVE-2025-58597 CVE record

CVSS 4.3 Medium

WordPress wpForo Forum Plugin <= 2.4.6 - Insecure Direct Object References (IDOR) Vulnerability
- Tomdever wpForo Forum
- Broken access control
Not analysed yet 3 Sept 2025
CVE-2025-4406 CVE record

CVSS 5.4 Medium

wpForo Forum <= 2.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar
- tomdever wpForo Forum
- Cross-site scripting (XSS)
Not analysed yet 10 Jul 2025
CVE-2025-31420 CVE record

CVSS 7.6 High

WordPress wpForo Forum plugin <= 2.4.2 - Privilege Escalation vulnerability
- Tomdever wpForo Forum
- Privilege escalation
Not analysed yet 4 Apr 2025
CVE-2025-0764 CVE record

CVSS 6.5 Medium

wpForo Forum <= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in update
- tomdever wpForo Forum
- CWE-20
Not analysed yet 28 Feb 2025
CVE-2024-3200 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

wpForo Forum <= 2.3.3 - Authenticated (Contributor+) SQL Injection
- tomdever wpForo Forum
- SQL injection
Not analysed yet 1 Jun 2024
CVE-2023-2249 CVE record

CVSS 8.8 HighCritical · CVSS 7+ and EPSS

wpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents
- tomdever wpForo Forum
- File inclusion
Not analysed yet 9 Jun 2023