VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

wpForo Forum security & vulnerabilities

wpforo— active installsLast vulnerability Nov 6, 2026

No known unpatched vulnerabilities in the latest version

All 59 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
59Known vulnerabilities
  • Critical4
  • High21
  • Medium34
  • Low0
Vulnerabilities per year
2018: 3 vulnerabilities3182020: 4 vulnerabilities4202021: 1 vulnerability1212022: 7 vulnerabilities7222023: 6 vulnerabilities6232024: 3 vulnerabilities3242025: 8 vulnerabilities8252026: 27 vulnerabilities2726

All wpForo Forum vulnerabilities

wpForo Forum vulnerabilities
SeverityVulnerabilityCVEPublished
High7.5Authenticated (Subscriber+) Privilege Escalation to 'data[secondary_groupids]' CSV Parameter
≤3.2.2Update to 3.2.3
CVE-2026-119164
High7.5Unauthenticated SQL Injection via 'data' Parameter
≤3.2.1Update to 3.2.2
CVE-2026-95870
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Reply Body in Moderation Forms
≤3.2.2Update to 3.2.3
CVE-2026-120532
High7.5Unauthenticated SQL Injection via 'href[locale]' Parameter
≤3.2.2Update to 3.2.3
CVE-2026-119155
Medium6.5Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal via 'theme' Parameter
≤3.2.2Update to 3.2.3
CVE-2026-110004
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field
≤3.1.6Update to 3.1.7
CVE-2026-93747
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤3.1.5Update to 3.1.6
CVE-2026-93772
High7.5Authenticated (Subscriber+) PHP Object Injection
≤3.1.5Update to 3.1.6
CVE-2026-80513
Medium5.33.1.5 - Unauthenticated AI Credit Exhaustion
3.0.0 – 3.1.5Update to 3.1.6
CVE-2026-80514
Medium4.3Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie
≤3.1.5Update to 3.1.6
CVE-2026-91092
High7.5Unauthenticated SQL Injection via 'referer' Parameter
≤2.4.17Update to 3.0.0
CVE-2026-5097
Medium4.3Missing Authorization to Authenticated (Subscriber+) Account Status Manipulation
≤3.1.2Update to 3.1.3
CVE-2026-12698
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤3.1.1Update to 3.1.2
CVE-2026-12696
Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Chat Message Deletion
≤3.1.1Update to 3.1.2
CVE-2026-12697
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field
≤3.1.1Update to 3.1.2
CVE-2026-15021
Medium6.5Authenticated (Contributor+) SQL Injection
≤3.0.9Update to 3.1.0
CVE-2026-57636
Medium5.3Missing Authorization
≤3.1.0Update to 3.1.1
CVE-2026-49767
High8.1Unauthenticated PHP Object Injection
≤3.1.0Update to 3.1.1
CVE-2026-49769
Medium5.3Missing Authorization
≤3.0.6Update to 3.0.7
CVE-2026-42682
High7.5Unauthenticated SQL Injection
≤3.0.4Update to 3.0.5
CVE-2026-40798
Medium5.3Missing Authorization
<3.0.2Update to 3.0.2
CVE-2026-40767
High8.1Authenticated (Subscriber+) Arbitrary File Deletion via Custom Profile Field File Path
≤3.0.5Update to 3.0.6
CVE-2026-6248
Medium6.5Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter
≤2.4.16Update to 3.0.0
CVE-2026-4666
High7.1Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter
≤3.0.2Update to 3.0.3
CVE-2026-5809
High8.8Authenticated (Subscriber+) Arbitrary File Deletion via Post Body
≤2.4.16Update to 2.4.17
CVE-2026-3666
High7.5Unauthenticated Time-Based SQL Injection
≤2.4.14Update to 2.4.15
CVE-2026-1581
High8.8Authenticated (Subscriber+) PHP Object Injection
≤2.4.13Update to 2.4.14
CVE-2026-0910
High7.5Unauthenticated SQL Injection
≤2.4.12Update to 2.4.13
CVE-2025-13126
Medium5.3Missing Authorization
≤2.4.10Update to 2.4.11
CVE-2025-66070
Medium6.5Authenticated (Susbscriber+) SQL Injection
≤2.4.9Update to 2.4.10
CVE-2025-11740
High7.5Unauthenticated SQL Injection via get_members Function
≤2.4.8Update to 2.4.9
CVE-2025-4203
Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
≤2.4.6Update to 2.4.7
CVE-2025-58597
Medium5.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar
≤2.4.5Update to 2.4.6
CVE-2025-4406
High8.8Authenticated (Subscriber+) Privilege Escalation
≤2.4.3Update to 2.4.4
CVE-2025-31420
Medium6.5Authenticated (Subscriber+) Arbitrary File Read in update
≤2.4.1Update to 2.4.2
CVE-2025-0764
Medium5.3Unauthenticated Sensitive Information Exposure
≤2.3.4Update to 2.3.5
CVE-2024-43289
Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
≤2.3.4Update to 2.3.5
CVE-2024-43288
Critical9.9Authenticated (Contributor+) SQL Injection
≤2.3.3Update to 2.3.4
CVE-2024-3200
Medium4.3Missing Authorization
≤2.2.5Update to 2.2.6
CVE-2023-47869
Critical9.8Unauthenticated Privilege Escalation
≤2.2.3Update to 2.2.4
CVE-2023-47868
Medium4.3Cross-Site Request Forgery via logout()
≤2.2.8Update to 2.2.9
CVE-2023-47870
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤2.2.3Update to 2.2.4
CVE-2023-47872
Medium6.1Reflected Cross-Site Scripting via 'wpforo_debug'
≤2.1.8Update to 2.1.9
CVE-2023-2309
High8.8Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents
≤2.1.7Update to 2.1.8
CVE-2023-2249
Medium5.4Authenticated (Subscriber+) HTML Injection
≤2.0.9Update to 2.1.0
CVE-2022-38055
Medium6.3Insecure Direct Object Reference to Forum Privacy Change
≤2.0.5Update to 2.0.6
CVE-2022-40206
High8.8Authenticated (Subscriber+) Arbitrary File Upload
≤2.0.9Update to 2.1.0
CVE-2022-40200
High8.8Cross-Site Request Forgery
≤2.0.9Update to 2.1.0
CVE-2022-40192
Medium5.4Insecure Direct Object Reference to Forum Status Change
≤2.0.5Update to 2.0.6
CVE-2022-40205
High8.8Cross-Site Request Forgery
≤2.0.5Update to 2.0.6
CVE-2022-40632
High8.8Cross-Site Request Forgery
≤2.0.5Update to 2.0.6
CVE-2022-38144
Medium6.1Open Redirect
≤1.9.6Update to 1.9.7
CVE-2021-24406
Medium6.1Cross-Site Scripting via wpf-dw-td-value class
≤1.6.5Update to 1.7.0
CVE-2019-19112
Medium4.8Cross-Site Scripting via s parameter
≤1.6.5Update to 1.7.0
CVE-2019-19110
Medium6.1Cross-Site Scripting via langid parameter
≤1.6.5Update to 1.7.0
CVE-2019-19111
High8.8Cross-Site Request Forgery
≤1.6.5Update to 1.7.0
CVE-2019-19109
Critical9.8Privilege Escalation
≤1.5.1Update to 1.5.2
CVE-2018-16613
Medium6.1Reflected Cross-Site Scripting
<1.4.12Update to 1.4.12
CVE-2018-11709
Critical9.8SQL Injection
≤1.4.12Update to 1.4.13
CVE-2018-11515

wpForo Forum: common questions

Does wpForo Forum have known vulnerabilities?

Yes. VulnCrest Radar lists 59 known vulnerabilities in wpForo Forum: 4 critical, 21 high, 34 medium. None are known to affect version null.

How do I check which version of wpForo Forum I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent wpForo Forum vulnerability?

CVE-2026-119164, published Nov 6, 2026: wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Privilege Escalation to 'data[secondary_groupids]' CSV Parameter. Severity: High (CVSS 7.5).

Is any wpForo Forum vulnerability listed in CISA KEV?

No. None of the known wpForo Forum vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?