Asgaros Forum

Asgaros Forum has 12 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2025; all 12 are fixed as of September 2026. Their average CVSS score is 6.9, and the most serious one scores 9.8 out of 10. Severity breakdown: 2 critical and 4 high. 2025 was the busiest year with 4 disclosures.

The most common weakness is SQL Injection, behind 4 of the records (33%). Other recurring categories include Cross-Site Request Forgery (CSRF), Cross-Site Scripting.

Every one of the 12 issues recorded for Asgaros Forum has a vendor fix available, so running the current release closes all known holes.

12 independent researchers contributed these findings, one record each. Asgaros Forum is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSMedium

6.9/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Asgaros Forum vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2024-22284

Asgaros Forum <= 2.7.2 - Unauthenticated PHP Object Injection in prepare_unread_status

Read the full analysis

Vulnerability Records

12 records


2025-11-11 15:30	Asgaros Forum <= 3.2.1 - Cross-Site Request Forgery to Subscription Settings Update Asgaros Forum <= 3.2.1	`CVE-2025-12901`	4.3 Medium	Brian Mungai	Yes
2025-11-07 14:15	Asgaros Forum <= 3.1.0 - Unauthenticated SQL Injection Asgaros Forum <= 3.1.0	`CVE-2025-11452`	7.5 High	Naoya Takahashi (nakko)	Yes
2025-04-16 00:00	Asgaros Forum <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Asgaros Forum <= 3.2.1	`CVE-2025-39514`	6.4 Medium	Muhammad Yudha - DJ	Yes
2025-04-07 00:00	Asgaros Forum <= 3.0.0 - Authenticated (Subscriber+) Authorization Bypass Asgaros Forum <= 3.0.0	`CVE-2025-32227`	4.3 Medium	20kilograma	Yes
2024-04-12 00:00	Asgaros Forum <= 2.8.0 - Cross-Site Request Forgery Asgaros Forum <= 2.8.0	`CVE-2024-32440`	4.3 Medium	Ananda Dhakal	Yes
2024-01-16 00:00	Asgaros Forum <= 2.7.2 - Unauthenticated PHP Object Injection in prepare_unread_status Asgaros Forum <= 2.7.2	`CVE-2024-22284`	9.8 Critical	Le Ngoc Anh	Yes
2023-12-06 00:00	Asgaros Forum <= 2.7.0 - Insufficient Authorization to Authenticated (Admin+) Arbitrary File Upload Asgaros Forum < 2.7.1	`CVE-2023-5604`	6.6 Medium	Rafael Aristodimou	Yes
2022-11-09 00:00	Asgaros Forum <= 2.1.0 - Cross-Site Request Forgery Asgaros Forum <= 2.1.0	`CVE-2022-41608`	8.8 High	Dhakal Ananda	Yes
2022-01-31 00:00	Asgaros Forum < 2.0.0 - SQL Injection Asgaros Forum < 2.0.0	`CVE-2022-0411`	8.8 High	Krzysztof Zając	Yes
2021-12-21 00:00	Asgaros Forum <= 1.15.14 - Admin+ SQL Injection via forum_id Asgaros Forum <= 1.15.14	`CVE-2021-25045`	7.2 High	Trang LKB	Yes

Showing 1–10 of 12 reports

Latestv3.4.0

Asgaros Forum

Author

Asgaros

4.8(208)

96/100

Last Updated

2026-03-21 (6mo ago)

Active Installs

10,000+

Downloads

926,585

Requires WP

6.4+

Requires PHP

5.3+

Tested up to

WP 6.9.7

Created

2015-12-29 (11y ago)

Asgaros Forum is the perfect WordPress plugin if you want to extend your website with a lightweight and feature-rich discussion board. It is easy to set up, super fast and perfectly integrated into WordPress. Support, Demo & Documentation Support & Demo Documentation Features Simple Content Management Profiles & Members List Notifications & Feeds Powerful Editor SEO-friendly Reactions Uploads Search Polls Widgets Statistics Guest Postings Approval, Banning & Reporting Moderators, Permissions & Usergroups Customizable Responsive Theme Multilingualism Multiple Instances Multisite Compatibility myCRED Integration Installation A new forum-page is automatically created during the installation Add this page to your menu so your users can access your forum Thats all!

View on WordPress.org