wpForo Forum

Explore wpForo Forum vulnerabilities across all versions. Currently tracking 45 known vulnerabilities, including severity, impact, and patch status.

01234567891026.06.2016Today27.05.20189.8wpForo Forum <= 1.4.12 - SQL Injection CVSS 9.8 · 27.05.201801.06.20186.1wpForo Forum < 1.4.12 - Reflected Cross-Site Scripting CVSS 6.1 · 01.06.201806.09.20189.8wpForo < = 1.5.1 - Privilege Escalation CVSS 9.8 · 06.09.201804.05.20206.1wpForo Forum <= 1.6.5 - Cross-Site Scripting via wpf-dw-td-value class CVSS 6.1 · 04.05.20204.8wpForo Forum <= 1.6.5 - Cross-Site Scripting via s parameter CVSS 4.8 · 04.05.20208.8wpForo Forum <= 1.6.5 - Cross-Site Request Forgery CVSS 8.8 · 04.05.20206.1wpForo Forum <= 1.6.5 - Cross-Site Scripting via langid parameter CVSS 6.1 · 04.05.202014.06.20216.1wpForo Forum <= 1.9.6 - Open Redirect CVSS 6.1 · 14.06.202108.09.20228.8wpForo Forum <= 2.0.5 - Cross-Site Request Forgery CVSS 8.8 · 08.09.20228.8wpForo Forum <= 2.0.5 - Cross-Site Request Forgery CVSS 8.8 · 08.09.202226.09.20225.4wpForo Forum <= 2.0.5 - Insecure Direct Object Reference to Forum Status Change CVSS 5.4 · 26.09.202209.11.20228.8wpForo Forum <= 2.0.9 - Cross-Site Request Forgery CVSS 8.8 · 09.11.20228.8wpForo Forum <= 2.0.9 - Authenticated (Subscriber+) Arbitrary File Upload CVSS 8.8 · 09.11.202226.11.20226.3wpForo Forum <= 2.0.5 - Insecure Direct Object Reference to Forum Privacy Change CVSS 6.3 · 26.11.202207.12.20225.4wpForo Forum <= 2.0.9 - Authenticated (Subscriber+) HTML Injection CVSS 5.4 · 07.12.202201.06.20238.8wpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents CVSS 8.8 · 01.06.202303.07.20236.1wpForo Forum <= 2.1.8 - Reflected Cross-Site Scripting via 'wpforo_debug' CVSS 6.1 · 03.07.202320.11.20234.3wpForo Forum <= 2.2.5 - Missing Authorization CVSS 4.3 · 20.11.20236.4wpForo Forum <= 2.2.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVSS 6.4 · 20.11.20239.8wpForo Forum <= 2.2.3 - Unauthenticated Privilege Escalation CVSS 9.8 · 20.11.20234.3wpForo Forum <= 2.2.8 - Cross-Site Request Forgery via logout() CVSS 4.3 · 20.11.202331.05.20249.9wpForo Forum <= 2.3.3 - Authenticated (Contributor+) SQL Injection CVSS 9.9 · 31.05.202416.08.20245.3wpForo Forum <= 2.3.4 - Unauthenticated Sensitive Information Exposure CVSS 5.3 · 16.08.20244.3wpForo Forum <= 2.3.4 - Authenticated (Subscriber+) Insecure Direct Object Reference CVSS 4.3 · 16.08.202427.02.20256.5wpForo Forum <= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in update CVSS 6.5 · 27.02.202502.04.20258.8wpForo Forum <= 2.4.3 - Authenticated (Subscriber+) Privilege Escalation CVSS 8.8 · 02.04.202509.07.20255.4wpForo Forum <= 2.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar CVSS 5.4 · 09.07.202503.09.20254.3wpForo Forum <= 2.4.6 - Authenticated (Subscriber+) Insecure Direct Object Reference CVSS 4.3 · 03.09.202524.10.20257.5wpForo Forum <= 2.4.8 - Unauthenticated SQL Injection via get_members Function CVSS 7.5 · 24.10.202531.10.20256.5wpForo Forum <= 2.4.9 - Authenticated (Susbscriber+) SQL Injection CVSS 6.5 · 31.10.202518.11.20255.3wpForo Forum <= 2.4.10 - Missing Authorization CVSS 5.3 · 18.11.202513.12.20257.5wpForo Forum <= 2.4.12 - Unauthenticated SQL Injection CVSS 7.5 · 13.12.202510.02.20268.8wpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection CVSS 8.8 · 10.02.202618.02.20267.5wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection CVSS 7.5 · 18.02.202603.04.20268.8wpForo Forum <= 2.4.16 - Authenticated (Subscriber+) Arbitrary File Deletion via Post Body CVSS 8.8 · 03.04.202610.04.20267.1wpForo Forum <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter CVSS 7.1 · 10.04.202616.04.20266.5wpForo Forum <= 2.4.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter CVSS 6.5 · 16.04.202620.04.20268.1wpForo Forum <= 3.0.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Custom Profile Field File Path CVSS 8.1 · 20.04.202621.04.20265.3wpForo Forum < 3.0.2 - Missing Authorization CVSS 5.3 · 21.04.202607.05.20267.5wpForo Forum <= 3.0.4 - Unauthenticated SQL Injection CVSS 7.5 · 07.05.202618.05.20265.3wpForo Forum <= 3.0.6 - Missing Authorization CVSS 5.3 · 18.05.202604.06.20268.1wpForo Forum <= 3.1.0 - Unauthenticated PHP Object Injection CVSS 8.1 · 04.06.20265.3wpForo Forum <= 3.1.0 - Missing Authorization CVSS 5.3 · 04.06.202626.06.20266.5wpForo Forum <= 3.0.9 - Authenticated (Contributor+) SQL Injection CVSS 6.5 · 26.06.202615.07.20266.4wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field CVSS 6.4 · 15.07.2026

Strategic Overview

Avg CVSSMedium
6.9/ 10
Patch Coverage100%
Open

0

Fixed

45

Get automatic notifications for all wpForo Forum vulnerabilities before they are exploited.

Vulnerability Records

45 records
2026-07-15 19:51CVE-2026-15021
6.4
Medium
valent1Yes
2026-06-26 00:00CVE-2026-57636
6.5
Medium
darooYes
2026-06-04 00:00CVE-2026-49769
8.1
High
darooYes
2026-06-04 00:00CVE-2026-49767
5.3
Medium
Jakub HermanYes
2026-05-18 00:00CVE-2026-42682
5.3
Medium
Tiago Ventura (perses)Yes
2026-05-07 00:00CVE-2026-40798
7.5
High
Nguyen Ba KhanhYes
2026-04-21 00:00CVE-2026-40767
5.3
Medium
Dahmani Toumi (pegaSUS)Yes
2026-04-20 05:51CVE-2026-6248
8.1
High
0xd4rk5id3Yes
2026-04-16 14:05CVE-2026-4666
6.5
Medium
Jared ReyesYes
2026-04-10 18:51CVE-2026-5809
7.1
High
Leonid Semenenko (lsemenenko)Yes
Showing 1–10 of 45 reports
wpForo Forum banner
Latestv3.1.4

wpForo Forum

Tomdever

Author

Tomdever

4.7(390)
94/100
Last Updated
2026-07-23 (6d ago)
Active Installs
20,000+
Downloads
1,756,664
Requires WP
5.2+
Requires PHP
7.1+
Tested up to
WP 7.0.2
Created
2016-06-26 (10y ago)

wpForo is the first AI powered forum plugin for WordPress. Full-fledged yet easy and light forum solution for your WordPress website. Comes with modern and responsive forum layouts and styles. This WordPress forum plugin brings everything you need to run an efficient and professional community. Powerful and beautiful forum with unique features. The best alternative to bbPress forum plugin. 5 Minute Forum Installation! 1. Activate plugin and find forums on /community/ page, (/community-2/ if /community/ is used), 2. Manage Forum Page, Title, etc in Dashboard > wpForo > Board > Edit Board admin page, 3. Manage Forums in Dashboard > wpForo > Forums admin page, 4. Manage Forum Menu in Dashboard > Appearance > Menu admin page, 5. Manage Forum Widgets in Dashboard > Appearance > Widgets admin page, 6. Manage Forum Colors in Dashboard > wpForo > Settings > Colors & Styles admin page, you can choose forum color styles. Support Forum and Demo: https://wpforo.com/community/ Forum Documentation: https://wpforo.com/docs/wpforo-v3/ GDPR Compliance: https://wpforo.com/docs/wpforo-v3/gdpr/ Multi-layout WordPress Forum Plugin Extended Forum Layout Simplified Forum Layout Question and Answer Forum Layout Threaded Forum Layout Boxed Forum Layout Migrate to wpForo Free Migration Tool Go2wpForo: https://wpforo.com/docs/wpforo-v3/migrate-to-wpforo/ - Migrate bbPress forum to wpForo - Migrate Asgaros forum to wpForo - Migrate SimplePress forum to wpForo - Migrate phpBB forum to wpForo - Migrate SMF forum to wpForo - Migrate Joomla Kunena forum to wpForo - Migrate MyBB forum to wpForo Forum Integration wpForo forum plugin is well integrated with many Profile Builder and Paid Membership plugins, such as BuddyPress, Ultimate Members, WooCommerce Membership, Paid Memberships Pro, MemberPress, Groups and SureMembers plugins. Forum Translation wpForo is a WordPress forum plugin with all possibilities of plugin translation. We’d really appreciate if you could help translating wpForo forum plugin to your language here. FORUM FEATURES 360° AI-Powered Features AI Semantic Search AI Topic Summarization AI Topic Suggestions AI Multi-Language Translation AI Chat Assistant AI Bot Reply & Suggest Reply AI Content Moderation AI Spam Detection AI Toxic Content Detection AI Tasks — Automated Topic Generation AI Tasks — Automated Reply Generation AI Tasks — Automated Topic Tag Moderation AI Analytics & Insights AI Knowledge Generation (RAG) AI Content Indexing – Text, Images, Documents Multi-board: Allows to have multiple separate forum pages Multi-language: Allows to forums with different languages Multi-layout: Four modern forum layouts (Q&A, Threaded…) Designed for small and extremely large forums/communities. Migrate from other forums using Go2wpForo tool. Four different forum layouts and designs. Six set of forum color styles including dark style. Super responsive forum on all kind of devices. Live user notification system Built-in forum SEO functions. Built-in forum Sitemap and Search Engine ping. Built-in forum Cache System. Built-in forum Antispam and Akismet integration. Advanced forum user profile system. Forum Member Rating and Badges. Built-in forum/topic subscription. Drag and Drop forum management system. Topic and Post front-end moderation. Forum topics and posts Read / Unread logging. Topic Tags and Tags Widget. Forum styles with different colors. Built-in, powerful forum Usergroup system. Forum Access sets per Usergroup per Forum. Forum Phrase System for quick translation. WordPress .MO/.PO translation files. Tools and options for GDPR Compliance Social Network Share Buttons BuddyPress Integration Ultimate Member Integration Need more forum features? Find wpForo forum plugin addons on gVectors Team website… Use of 3rd Party Services wpForo connects to external services operated by gVectors Team for certain features. These connections are optional and only active when the corresponding features are enabled by the forum administrator. gVectors AI API (api.gvectors.com, api.gvectors.net) When AI features are enabled by the forum administrator, wpForo sends forum content (topics, posts, and metadata) to the gVectors AI API for processing. This includes: Content Indexing: Forum content is sent to embedding generation for vector database Semantic Search: Query is sent for embedding for vector search AI Translation: Forum text is sent for translation into other languages AI Summarization: Topic content is sent for automatic summary generation Content Moderation: New posts are sent for AI-powered content analysis AI Chat: Conversation context is sent for AI response generation Topic Suggestions: Forum data is sent for generating related topic recommendations No data is sent to the AI API unless the forum administrator explicitly enables AI features, accepts the Terms of Service and Privacy Policy, and configures an API key. A fallback domain (api.gvectors.net) may be used automatically if the primary domain is unreachable. Terms of Service Privacy Policy gVectors Addons Store (gvectors.com) When using wpForo addons purchased from the gVectors store, the plugin communicates with gvectors.com to verify addon licenses and deliver automatic updates through the WordPress Dashboard. This includes sending your site URL and license key to validate your purchase and check for available addon updates. Terms of Service Privacy Policy

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C