Log in Start free

Tomdever

Products

ProductCVEsExploitedLatest
wpForo Forum27–Sep 25, 2026

Exploited and recent CVEs

  • CVE-2026-93747 Medium 6.4 wpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field 0.2%
  • CVE-2026-93772 Medium 6.5 WordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-91092 Medium 4.3 wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie 0.4%
  • CVE-2026-5097 High 7.5 wpForo Forum <= 2.4.17 - Unauthenticated SQL Injection via 'referer' Parameter 0.6%
  • CVE-2026-15021 Medium 6.4 wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field 0.4%
  • CVE-2026-57636 High 8.5 WordPress wpForo Forum plugin <= 3.0.9 - SQL Injection vulnerability 0.4%
  • CVE-2026-49767 Critical 9.8 WordPress wpForo Forum plugin <= 3.1.0 - Broken Authentication vulnerability 0.5%
  • CVE-2026-49769 Critical 9.8 WordPress wpForo Forum plugin <= 3.1.0 - PHP Object Injection vulnerability 0.3%
  • CVE-2026-40798 Critical 9.3 WordPress wpForo Forum plugin <= 3.0.4 - SQL Injection vulnerability 0.3%
  • CVE-2026-40767 High 7.5 WordPress wpForo Forum plugin < 3.0.2 - Broken Access Control vulnerability 0.3%
  • CVE-2026-42682 Critical 9.1 WordPress wpForo Forum plugin <= 3.0.6 - Broken Access Control vulnerability 0.3%
  • CVE-2026-6248 High 8.1 wpForo Forum <= 3.0.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Custom Profile Field File Path 0.6%
  • CVE-2026-4666 Medium 6.5 wpForo Forum <= 2.4.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter 0.3%
  • CVE-2026-5809 High 7.1 wpForo Forum <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter 0.5%
  • CVE-2026-3666 High 8.8 wpForo Forum <= 2.4.16 - Authenticated (Subscriber+) Arbitrary File Deletion via Post Body 0.5%
  • CVE-2026-1581 High 7.5 wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection 2.5%
  • CVE-2026-0910 High 8.8 wpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection 0.6%
  • CVE-2025-66070 High 7.5 WordPress wpForo Forum plugin <= 2.4.10 - Broken Access Control vulnerability 0.3%
  • CVE-2025-13126 High 7.5 wpForo Forum <= 2.4.12 - Unauthenticated SQL Injection 0.4%
  • CVE-2025-11740 Medium 6.5 wpForo Forum <= 2.4.9 - Authenticated (Susbscriber+) SQL Injection 0.3%
  • CVE-2025-4203 High 7.5 wpForo Forum <= 2.4.8 - Unauthenticated SQL Injection via get_members Function 0.4%
  • CVE-2025-58597 Medium 4.3 WordPress wpForo Forum Plugin <= 2.4.6 - Insecure Direct Object References (IDOR) Vulnerability 0.3%
  • CVE-2025-4406 Medium 5.4 wpForo Forum <= 2.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar 0.2%
  • CVE-2025-31420 High 7.6 WordPress wpForo Forum plugin <= 2.4.2 - Privilege Escalation vulnerability 0.3%
  • CVE-2025-0764 Medium 6.5 wpForo Forum <= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in update 0.4%
  • CVE-2024-3200 Critical 9.9 wpForo Forum <= 2.3.3 - Authenticated (Contributor+) SQL Injection 0.5%
  • CVE-2023-2249 High 8.8 wpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents 60.8%