Advisories · Technology

wpForo Forum.

Every CVE that names wpForo Forum among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-80514 CVE record

CVSS 5.3 Medium

wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit Bypass
- wpForo Forum
- CWE-348
Not analysed yet 25 Sept 2026
CVE-2026-80513 CVE record

CVSS 7.5 High

wpForo Forum < 3.1.6 - Subscriber+ PHP Object Injection via Profile Fields
- wpForo Forum
- Insecure deserialization
Not analysed yet 24 Sept 2026
CVE-2026-12698 CVE record

CVSS 4.3 Medium

wpForo Forum < 3.1.3 - Subscriber+ Account Status and Reputation Manipulation via Profile Update Mass Assignment
- wpForo Forum
- Broken access control
Not analysed yet 4 Aug 2026
CVE-2026-12696 CVE record

CVSS 5.4 Medium

wpForo Forum < 3.1.2 - Subscriber+ Stored XSS via Profile Location Field
- wpForo Forum
- Cross-site scripting (XSS)
Not analysed yet 1 Aug 2026
CVE-2026-12697 CVE record

CVSS 5.4 Medium

wpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDOR
- wpForo Forum
- Broken access control
Not analysed yet 31 Jul 2026
CVE-2023-47868 CVE record

CVSS 7.3 High

WordPress wpForo plugin <= 2.2.3 - Privilege Escalation vulnerability
- wpForo Forum
- Privilege escalation
Not analysed yet 17 May 2024
CVE-2023-2309 CVE record

wpForo Forum < 2.1.9 - Reflected Cross-Site Scripting
- wpForo Forum
Not analysed yet 24 Jul 2023