WP Forum Server

WP Forum Server has 6 disclosed vulnerabilities in the WordSec catalog, reported between 2011 and 2025; 4 are fixed and 2 remain unpatched as of September 2026. Their average CVSS score is 6.6, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 2 high. 2012 was the busiest year with 3 disclosures.

The most common weakness is SQL Injection, behind 3 of the records (50%). Other recurring categories include Cross-Site Scripting, Cross-Site Request Forgery (CSRF).

4 of the records (67%) have a vendor fix, while 2 remain unpatched. The oldest unresolved one dates back to 2025.

3 independent researchers contributed these findings, most of them (3) reported by Heine Pedersen. WP Forum Server is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 4.2.39.

Strategic Overview

Avg CVSSMedium

6.6/ 10

Patch Coverage67%

Open

Fixed

Get automatic notifications for all WP Forum Server vulnerabilities before they are exploited.

Most severe open issueCVSS 4.9CVE-2025-53306

WP Forum Server <= 1.8.2 - Authenticated (Administrator+) SQL Injection

Read the full analysis

Vulnerability Records

6 records


2025-06-27 00:00	WP Forum Server <= 1.8.2 - Cross-Site Request Forgery WP Forum Server <= 1.8.2	`CVE-2025-53305`	4.3 Medium	Nguyen Xuan Chien	No
2025-06-27 00:00	WP Forum Server <= 1.8.2 - Authenticated (Administrator+) SQL Injection WP Forum Server <= 1.8.2	`CVE-2025-53306`	4.9 Medium	Nguyen Xuan Chien	No
2012-05-15 00:00	WP Forum Server <= 1.7.3 - Authenticated (Admin+) Stored Cross-Site Scripting WP Forum Server <= 1.7.3	`CVE-2012-6622`	6.1 Medium	Heine Pedersen	Yes
2012-05-15 00:00	WP Forum Server < 1.7.5 - Cross-Site Scripting WP Forum Server < 1.7.5	`CVE-2012-6623`	7.1 High	Heine Pedersen	Yes
2012-05-15 00:00	WP Forum Server < 1.7.4 - SQL Injection WP Forum Server < 1.7.4	`CVE-2012-6625`	7.2 High	Heine Pedersen	Yes
2011-02-22 00:00	WP Forum Server <= 1.6.5 - SQL Injection WP Forum Server <= 1.6.5	`CVE-2011-1047`	9.8 Critical	High-Tech Bridge Security Research Lab	Yes

Showing 1–6 of 6 reports

Plugin Profile

Latestv1.8.2

WP Forum Server

Author

lucidcrew

3.3(12)

66/100

Last Updated

2015-05-07 (12y ago)

Active Installs

100+

Downloads

233,151

Requires WP

2.6+

Requires PHP

Tested up to

WP 4.2.39

Created

2009-07-18 (17y ago)

WP Forum Server : A complete forum system for your wordpress blog. The forum is a plugin, so no additional work is needed to integrate it into your site. WP Forum Server is a an advanced, stable fork of WP Forum. If there are any problems installing this plugin please visit the site at http://forumpress.org/ and download the plugin from there. If you want to show off your forum please visit: http://forumpress.org/support/forumpress-g5/forum-server-1.4-and-previous-archive-f19 and leave a link to your site.

View on WordPress.org