Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?Asgaros ForumreCAPTCHA (v2 & v3) for Asgaros Forum
Plugin · asgaros-forum
Asgaros Forum
13 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 9, 2026Asgaros Forum: Missing AuthorizationCVE-2026-39779 · affects up to 3.4.0 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Asgaros Asgaros Forum asgaros-forum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Asgaros Forum: from n/a through 3.4.0.
Nov 12, 2025Asgaros Forum: Cross-Site Request ForgeryCVE-2025-12901 · affects up to 3.2.1 · reported by WordfenceMedium 4.3
The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce validation on the set_subscription_level() function. This makes it possible for unauthenticated attackers to modify the subscription settings of authenticated users via a forged request granted they can trick a logged-in user into performing an action such as clicking on a link.
Nov 7, 2025Asgaros Forum: SQL InjectionCVE-2025-11452 · affects up to 3.1.0 · reported by WordfenceHigh 7.5
The Asgaros Forum plugin for WordPress is vulnerable to SQL Injection via the '$_COOKIE['asgarosforum_unread_exclude']' cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Apr 16, 2025Asgaros Forum: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39514 · affects up to 3.2.1 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Asgaros Asgaros Forum asgaros-forum allows Stored XSS.This issue affects Asgaros Forum: from n/a through <= 3.2.1.
Apr 10, 2025Asgaros Forum: Authentication Bypass by SpoofingCVE-2025-32227 · affects up to 3.0.0 · reported by PatchstackMedium 4.3
Authentication Bypass by Spoofing vulnerability in Asgaros Asgaros Forum asgaros-forum allows Identity Spoofing.This issue affects Asgaros Forum: from n/a through <= 3.0.0.
Apr 15, 2024Asgaros Forum: Cross-Site Request Forgery (CSRF)CVE-2024-32440 · affects up to 2.8.0 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Thomas Belser Asgaros Forum.This issue affects Asgaros Forum: from n/a through 2.8.0.
Jan 24, 2024Asgaros Forum: Deserialization of Untrusted DataCVE-2024-22284 · affects up to 2.7.2 · reported by PatchstackHigh 8.7
Deserialization of Untrusted Data vulnerability in Thomas Belser Asgaros Forum.This issue affects Asgaros Forum: from n/a through 2.7.2.
Nov 27, 2023Asgaros Forum: Allows forum administratorsCVE-2023-5604 · fixed in 2.7.1 · reported by WPScanCritical 9.8
The Asgaros Forum WordPress plugin before 2.7.1 allows forum administrators, who may not be WordPress (super-)administrators, to set insecure configuration that allows unauthenticated users to upload dangerous files (e.g. .php, .phtml), potentially leading to remote code execution.
May 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in Thomas Belser Asgaros Forum plugin <= 2.2.0 versions.CVE-2022-41608 · fixed in 2.3.0 · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Thomas Belser Asgaros Forum plugin <= 2.2.0 versions.
Feb 28, 2022Asgaros Forum: Does not sanitise and escape the post_id parameter before using it in a SQL statement via a REST route of the plugin (accessible to any authenticated user)CVE-2022-0411 · fixed in 2.0.0 · reported by WPScanHigh 8.8
The Asgaros Forum WordPress plugin before 2.0.0 does not sanitise and escape the post_id parameter before using it in a SQL statement via a REST route of the plugin (accessible to any authenticated user), leading to a SQL injection
Jan 24, 2022Asgaros Forum: Does not validate or escape the forum_id parameter before using it in a SQL statementCVE-2021-25045 · fixed in 1.15.15 · reported by WPScanHigh 7.2
The Asgaros Forum WordPress plugin before 1.15.15 does not validate or escape the forum_id parameter before using it in a SQL statement when editing a forum, leading to an SQL injection issue
Nov 29, 2021Asgaros Forums: Stored Cross-Site ScriptingCVE-2021-42365 · affects up to 1.15.13 · reported by WordfenceMedium 4.8
The Asgaros Forums WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the name parameter found in the ~/admin/tables/admin-structure-table.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.15.13. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Nov 8, 2021Asgaros Forum: Does not validate and escape user inputCVE-2021-24827 · fixed in 1.15.13 · reported by WPScanCritical 9.8
The Asgaros Forum WordPress plugin before 1.15.13 does not validate and escape user input when subscribing to a topic before using it in a SQL statement, leading to an unauthenticated SQL injection issue
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.