CVE Tools
Track your stack

Wpforo Forum

53 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Wpforo Forum, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Wpforo Forum CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Wpforo Forum CVEs per month
MonthCVEs
2024-110
2024-121
2025-010
2025-021
2025-030
2025-041
2025-050
2025-060
2025-071
2025-080
2025-091
2025-101
2025-111
2025-122
2026-010
2026-0211
2026-030
2026-044
2026-050
2026-066
2026-071
2026-081
2026-093
2026-100

Severity

How the 53 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical713%
  • High1834%
  • Medium2853%

Latest CVEs

The 15 most recently published vulnerabilities affecting Wpforo Forum.

  1. CVE-2026-93747wpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field6.4
  2. CVE-2026-93772WordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability6.5
  3. CVE-2026-91092wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie4.3
  4. CVE-2026-5097wpForo Forum <= 2.4.17 - Unauthenticated SQL Injection via 'referer' Parameter7.5
  5. CVE-2026-15021wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field6.4
  6. CVE-2026-57636WordPress wpForo Forum plugin <= 3.0.9 - SQL Injection vulnerability8.5
  7. CVE-2026-49767WordPress wpForo Forum plugin <= 3.1.0 - Broken Authentication vulnerability9.8
  8. CVE-2026-49769WordPress wpForo Forum plugin <= 3.1.0 - PHP Object Injection vulnerability9.8
  9. CVE-2026-40798WordPress wpForo Forum plugin <= 3.0.4 - SQL Injection vulnerability9.3
  10. CVE-2026-40767WordPress wpForo Forum plugin < 3.0.2 - Broken Access Control vulnerability7.5
  11. CVE-2026-42682WordPress wpForo Forum plugin <= 3.0.6 - Broken Access Control vulnerability9.1
  12. CVE-2026-6248wpForo Forum <= 3.0.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Custom Profile Field File Path8.1
  13. CVE-2026-4666wpForo Forum <= 2.4.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter6.5
  14. CVE-2026-5809wpForo Forum <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter7.1
  15. CVE-2026-3666wpForo Forum <= 2.4.16 - Authenticated (Subscriber+) Arbitrary File Deletion via Post Body8.8

Product grouping is registry-driven, with AI assist and human review. How it works