WordPress plugin · wpforo
Is wpForo Forum safe?
Safe on 3.2.2 or newer.
The current version, 3.2.2, is past every affected range on record (46 of 57 records list one; 11 don’t, so check those below). Keep it updated and you’re clear of them.
- Flaws on record
- 57
- High or critical
- 27
- Exploited
- none
- Current version
- 3.2.2
- Last updated
- Sep 28, 2026
- Active installs
- 20,000+
Every recorded flaw
- Sep 25, 2026wpForo Forum: Stored Cross-Site ScriptingCVE-2026-93747 · affects up to 3.1.6 · reported by WordfenceMedium 6.4
- Sep 24, 2026wpForo Forum: Does not restrictCVE-2026-80513 · fixed in 3.1.6 · reported by WPScanHigh 7.5
- Sep 23, 2026Subscriber Cross Site Scripting (XSS) in wpForo Forum <= 3.1.5 versions.CVE-2026-93772 · affects up to 3.1.5 · reported by PatchstackMedium 6.5
- Sep 22, 2026wpForo Forum: Authorization bypassCVE-2026-91092 · affects up to 3.1.5 · reported by WordfenceMedium 4.3
- Aug 28, 2026wpForo Forum: SQL InjectionCVE-2026-5097 · affects up to 2.4.17 · reported by WordfenceHigh 7.5
- Aug 4, 2026wpForo Forum: Does not restrictCVE-2026-12698 · fixed in 3.1.3 · reported by WPScanMedium 4.3
- Aug 1, 2026wpForo Forum: Does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile pageCVE-2026-12696 · fixed in 3.1.2 · reported by WPScanMedium 5.4
- Jul 31, 2026wpForo Forum: Does not verify that an AI chat conversation belongs to the requesting user before deleting its messagesCVE-2026-12697 · fixed in 3.1.2 · reported by WPScanMedium 5.4
- Jul 16, 2026wpForo Forum: Stored Cross-Site ScriptingCVE-2026-15021 · affects up to 3.1.1 · reported by WordfenceMedium 6.4
- Jun 26, 2026Contributor SQL Injection in wpForo Forum <= 3.0.9 versions.CVE-2026-57636 · reported by PatchstackHigh 8.5
- Jun 17, 2026Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions.CVE-2026-49767 · affects up to 3.1.0 · reported by PatchstackCritical 9.8
- Jun 15, 2026Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions.CVE-2026-49769 · affects up to 3.1.0 · reported by PatchstackCritical 9.8
- Jun 15, 2026Unauthenticated SQL Injection in wpForo Forum <= 3.0.4 versions.CVE-2026-40798 · affects up to 3.0.4 · reported by PatchstackCritical 9.3
- Jun 15, 2026Unauthenticated Broken Access Control in wpForo Forum < 3.0.2 versions.CVE-2026-40767 · reported by PatchstackHigh 7.5
- Jun 1, 2026wpForo Forum: Missing AuthorizationCVE-2026-42682 · affects up to 3.0.6 · reported by PatchstackCritical 9.1
- Apr 20, 2026wpForo Forum: Arbitrary File DeletionCVE-2026-6248 · affects up to 3.0.5 · reported by WordfenceHigh 8.1
- Apr 17, 2026wpForo Forum: Unauthorized modification of dataCVE-2026-4666 · affects up to 2.4.16 · reported by WordfenceMedium 6.5
- Apr 11, 2026wpForo Forum: Arbitrary File DeletionCVE-2026-5809 · affects up to 3.0.2 · reported by WordfenceHigh 7.1
- Apr 4, 2026wpForo Forum: Arbitrary file deletionCVE-2026-3666 · affects up to 2.4.16 · reported by WordfenceHigh 8.8
- Feb 28, 2026Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers: WpForo 2.4.14 contains an unauthenticated SQL injectionCVE-2026-28562 · reported by VulnCheckHigh 8.8
- Feb 28, 2026wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows administrators to inject persistent JavaScript via forum description fieldsCVE-2026-28561 · reported by VulnCheckMedium 4.8
- Feb 28, 2026wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inline script block usinCVE-2026-28560 · reported by VulnCheckMedium 4.8
- Feb 28, 2026wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retrieve private and unapproved forum topics via the gCVE-2026-28559 · reported by VulnCheckMedium 6.9
- Feb 28, 2026wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows authenticated subscribers to upload SVG files as profile avatars through thCVE-2026-28558 · reported by VulnCheckMedium 5.1
- Feb 28, 2026wpForo Forum 2.4.14 contains a missing capability check vulnerability that allows authenticated users to trigger bulk wpForo usergroup reassignment via the wpfoCVE-2026-28557 · reported by VulnCheckHigh 7.1
- Feb 28, 2026wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to move, merge, or split any forum topic via the topic_CVE-2026-28556 · reported by VulnCheckMedium 5.3
- Feb 28, 2026wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to close or reopen any forum topic via the wpforo_closeCVE-2026-28555 · reported by VulnCheckMedium 5.3
- Feb 28, 2026wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to approve or unapprove any forum post via the wpforo_aCVE-2026-28554 · reported by VulnCheckMedium 5.3
- Feb 19, 2026wpForo Forum: Time-based SQL InjectionCVE-2026-1581 · affects up to 2.4.14 · reported by Wordfence2.5% oddsHigh 7.5
- Feb 11, 2026wpForo Forum: PHP Object InjectionCVE-2026-0910 · affects up to 2.4.13 · reported by WordfenceHigh 8.8
- Dec 18, 2025wpForo Forum: Missing AuthorizationCVE-2025-66070 · affects up to 2.4.10 · reported by PatchstackHigh 7.5
- Dec 14, 2025wpForo Forum: Generic SQL InjectionCVE-2025-13126 · affects up to 2.4.12 · reported by WordfenceHigh 7.5
- Nov 1, 2025wpForo Forum: SQL InjectionCVE-2025-11740 · affects up to 2.4.9 · reported by WordfenceMedium 6.5
- Oct 25, 2025wpForo Forum: Error‐based or time-based SQL InjectionCVE-2025-4203 · affects up to 2.4.8 · reported by WordfenceHigh 7.5
- Sep 3, 2025wpForo Forum: Authorization Bypass Through User-Controlled KeyCVE-2025-58597 · affects up to 2.4.6 · reported by PatchstackMedium 4.3
- Jul 9, 2025wpForo Forum: Stored Cross-Site ScriptingCVE-2025-4406 · affects up to 2.4.5 · reported by WordfenceMedium 5.4
- Apr 4, 2025wpForo Forum: Incorrect Privilege AssignmentCVE-2025-31420 · affects up to 2.4.2 · reported by PatchstackHigh 7.6
- Feb 28, 2025wpForo Forum: Arbitrary file readCVE-2025-0764 · affects up to 2.4.1 · reported by WordfenceMedium 6.5
- Dec 9, 2024wpForo Forum: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2023-47869 · affects up to 2.2.5 · reported by PatchstackMedium 4.3
- Aug 26, 2024wpForo Forum: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-43289 · affects up to 2.3.4 · reported by PatchstackHigh 7.5
- Aug 18, 2024wpForo Forum: Authorization Bypass Through User-Controlled KeyCVE-2024-43288 · affects up to 2.3.4 · reported by PatchstackMedium 4.3
- Jun 21, 2024wpForo Forum: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2022-38055 · affects up to 2.0.9 · reported by PatchstackMedium 4.3
- Jun 1, 2024wpForo Forum: SQL InjectionCVE-2024-3200 · affects up to 2.3.3 · reported by WordfenceCritical 9.9
- May 17, 2024wpForo Forum: Improper Privilege ManagementCVE-2023-47868 · affects up to 2.2.3 · reported by PatchstackHigh 7.3
- Nov 30, 2023wpForo Forum: Cross-Site Request Forgery (CSRF), Missing AuthorizationCVE-2023-47870 · affects up to 2.2.6 · reported by PatchstackMedium 5.7
- Nov 30, 2023wpForo Forum: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-47872 · affects up to 2.2.3 · reported by PatchstackMedium 6.5
- Jul 24, 2023wpForo Forum: Does not escape some request parameters while in debug modeCVE-2023-2309 · fixed in 2.1.9 · reported by WPScanMedium 6.1
- Jun 9, 2023wpForo Forum: Local File Include, Server-Side Request Forgery, and PHAR DeserializationCVE-2023-2249 · affects up to 2.1.7 · reported by Wordfence61% oddsHigh 8.8
- Nov 17, 2022Auth.CVE-2022-40200 · affects up to 2.0.9 · reported by PatchstackCritical 9.9
- Nov 17, 2022Cross-Site Request Forgery (CSRF) vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress.CVE-2022-40192 · affects up to 2.0.9 · reported by PatchstackHigh 7.1
- Nov 8, 2022Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 on WordPress leading to topic deletion.CVE-2022-40632 · affects up to 2.0.5 · reported by PatchstackMedium 5.4
- Nov 8, 2022the wpForo Forum plugin <= 2.0.5 on: Insecure direct object references (IDOR)CVE-2022-40206 · affects up to 2.0.5 · reported by PatchstackMedium 6.3
- Nov 8, 2022the wpForo Forum plugin <= 2.0.5 on: Insecure direct object references (IDOR)CVE-2022-40205 · affects up to 2.0.5 · reported by PatchstackMedium 5.4
- Sep 9, 2022Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 at WordPress.CVE-2022-38144 · affects up to 2.0.5 · reported by PatchstackHigh 8.8
- Jul 6, 2021wpForo Forum: Did not validate the redirect_to parameter in the login form of the forumCVE-2021-24406 · fixed in 1.9.7 · reported by WPScan2.9% oddsMedium 6.1
- Jun 19, 2019An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress.CVE-2018-16613 · fixed in 1.5.2 · reported by MITRE2.7% oddsCritical 9.8
- Jun 4, 2018wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected Cross-Site ScriptinCVE-2018-11709 · fixed in 1.4.12 · reported by MITRE3.5% oddsMedium 6.1
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Get in touch
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
Not ready to talk yet? Run the free website check and see what Google sees.