ForumWP – Forum & Discussion Board

ForumWP – Forum & Discussion Board has 6 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 6 are fixed as of September 2026. Their average CVSS score is 6.9, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 1 high. 2024 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (50%). Other recurring categories include Authorization Bypass Through User-Controlled Key, Deserialization Of Untrusted Data.

Every one of the 6 issues recorded for ForumWP – Forum & Discussion Board has a vendor fix available, so running the current release closes all known holes.

5 independent researchers contributed these findings, most of them (2) reported by Peter Thaleikis. ForumWP – Forum & Discussion Board is installed on roughly 800 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSMedium

6.9/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all ForumWP – Forum & Discussion Board vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2024-54367

ForumWP <= 2.1.0 - Unauthenticated PHP Object Injection

Read the full analysis

Vulnerability Records

6 records


2026-01-05 14:45	ForumWP – Forum & Discussion Board <= 2.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name ForumWP <= 2.1.6	`CVE-2025-13746`	6.4 Medium	Sergej Ljubojevic	Yes
2025-11-21 00:00	ForumWP <= 2.1.4 - Missing Authorization ForumWP <= 2.1.4	`CVE-2025-67474`	4.3 Medium	daroo	Yes
2024-12-11 00:00	ForumWP <= 2.1.0 - Unauthenticated PHP Object Injection ForumWP <= 2.1.0	`CVE-2024-54367`	9.8 Critical	Kévin Mosbahi (Mika)	Yes
2024-12-05 19:50	ForumWP – Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site Scripting ForumWP <= 2.1.2	`CVE-2024-10879`	6.1 Medium	Peter Thaleikis	Yes
2024-12-05 19:44	ForumWP – Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site Scripting via url Parameter ForumWP <= 2.1.2	`CVE-2024-11204`	6.1 Medium	Peter Thaleikis	Yes
2024-09-06 01:21	ForumWP – Forum & Discussion Board Plugin <= 2.0.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via Account Takeover ForumWP <= 2.0.2	`CVE-2024-8428`	8.8 High	wesley (wcraft)	Yes

Showing 1–6 of 6 reports

Latestv2.1.9

ForumWP – Forum & Discussion Board

Author

Ultimate Member

3.6(12)

72/100

Last Updated

2026-04-01 (6mo ago)

Active Installs

800+

Downloads

32,612

Requires WP

5.5+

Requires PHP

7.0+

Tested up to

WP 6.9.7

Created

2021-03-02 (6y ago)

ForumWP is a forum plugin which adds an online forum to your website. With ForumWP you can easily create forums and allow users to create topics and write replies. Features of the plugin include: Forum visibility Forum styling Topics list Topics search Replies list Sub-replies and sorting User login & registration Profile page Easy settings Manage forums, topics and replies Manage modules and email settings Read about all of the plugin’s features at ForumWP Documentation & Support Got a problem or need help with ForumWP? Head over to our documentation and perform a search of the knowledge base. If you can’t find a solution to your issue then you can create a topic on the support forum.

View on WordPress.org