wpForo Forum

Güvenlik açıkları

• CVE-2026-49767kimlik doğrulamasız≤ 3.1.0

  WordPress wpForo Forum plugin <= 3.1.0 - Broken Authentication vulnerability

  Kritik 9.8

• CVE-2026-49769kimlik doğrulamasız≤ 3.1.0

  WordPress wpForo Forum plugin <= 3.1.0 - PHP Object Injection vulnerability

  Kritik 9.8

• CVE-2023-47868kimlik doğrulamasız≤ 2.2.3

  WordPress wpForo plugin <= 2.2.3 - Privilege Escalation vulnerability

  Kritik 9.8

• CVE-2018-16613kimlik doğrulamasız

  An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress.

  Kritik 9.8

• CVE-2026-40798kimlik doğrulamasız≤ 3.0.4

  WordPress wpForo Forum plugin <= 3.0.4 - SQL Injection vulnerability

  Kritik 9.3

• CVE-2026-42682kimlik doğrulamasız≤ 3.0.6

  WordPress wpForo Forum plugin <= 3.0.6 - Broken Access Control vulnerability

  Kritik 9.1

• CVE-2026-28562kimlik doğrulamasız→ 2.4.15

  wpForo Forum 2.4.14 SQL Injection via Topics ORDER BY Parameter

  Yüksek 8.8

• CVE-2022-40192kimlik doğrulamasız · tıklama gerekir≤ 2.0.9

  WordPress wpForo Forum plugin <= 2.0.9 - Cross-Site Request Forgery (CSRF) vulnerability

  Yüksek 8.8

• CVE-2022-38144kimlik doğrulamasız · tıklama gerekir≤ 2.0.5

  WordPress wpForo Forum plugin <= 2.0.5 - Cross-Site Request Forgery (CSRF) vulnerability

  Yüksek 8.8

• CVE-2026-0910abone+≤ 2.4.13

  wpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection

  Yüksek 8.8

• CVE-2023-47870giriş gerekir≤ 2.2.6

  WordPress wpForo Forum Plugin <= 2.2.6 is vulnerable to Broken Access Control and Cross Site Request Forgery (CSRF)

  Yüksek 8.8

• CVE-2023-2249abone+≤ 2.1.7

  wpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents

  Yüksek 8.8

• CVE-2022-40200abone+≤ 2.0.9

  WordPress wpForo Forum plugin <= 2.0.9 - Auth. Arbitrary File Upload vulnerability

  Yüksek 8.8

• CVE-2026-57636katılımcı+≤ 3.0.9

  WordPress wpForo Forum plugin <= 3.0.9 - SQL Injection vulnerability

  Yüksek 8.5

• CVE-2026-6248abone+≤ 3.0.5

  wpForo Forum <= 3.0.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Custom Profile Field File Path

  Yüksek 8.1

• CVE-2024-43288giriş gerekir≤ 2.3.4

  WordPress wpForo Forum plugin <= 2.3.4 - Insecure Direct Object References (IDOR) vulnerability

  Yüksek 8.1

• CVE-2025-31420giriş gerekir≤ 2.4.2

  WordPress wpForo Forum plugin <= 2.4.2 - Privilege Escalation vulnerability

  Yüksek 7.6

• CVE-2026-5097kimlik doğrulamasız≤ 2.4.17

  wpForo Forum <= 2.4.17 - Unauthenticated SQL Injection via 'referer' Parameter

  Yüksek 7.5

• CVE-2026-40767kimlik doğrulamasız→ 3.0.2

  WordPress wpForo Forum plugin < 3.0.2 - Broken Access Control vulnerability

  Yüksek 7.5

• CVE-2026-1581kimlik doğrulamasız≤ 2.4.14

  wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection

  Yüksek 7.5

• CVE-2025-66070kimlik doğrulamasız≤ 2.4.10

  WordPress wpForo Forum plugin <= 2.4.10 - Broken Access Control vulnerability

  Yüksek 7.5

• CVE-2025-13126kimlik doğrulamasız≤ 2.4.12

  wpForo Forum <= 2.4.12 - Unauthenticated SQL Injection

  Yüksek 7.5

• CVE-2025-4203kimlik doğrulamasız≤ 2.4.8

  wpForo Forum <= 2.4.8 - Unauthenticated SQL Injection via get_members Function

  Yüksek 7.5

• CVE-2024-43289kimlik doğrulamasız≤ 2.3.4

  WordPress wpForo Forum plugin <= 2.3.4 - Unauthenticated Sensitive Data Exposure vulnerability

  Yüksek 7.5

• CVE-2026-5809abone+≤ 3.0.2

  wpForo Forum <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter

  Yüksek 7.1

• CVE-2026-28557giriş gerekir→ 2.4.16

  wpForo Forum < 2.4.16 Privilege Escalation via Role Synchronization Handler

  Yüksek 7.1

• CVE-2026-28559kimlik doğrulamasız→ 2.4.16

  wpForo Forum 2.4.14 Information Disclosure via Global RSS Feed

  Orta 6.9

• CVE-2026-93772abone+≤ 3.1.5

  WordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability

  Orta 6.5

• CVE-2026-4666abone+≤ 2.4.16

  wpForo Forum <= 2.4.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter

  Orta 6.5

• CVE-2025-11740abone+≤ 2.4.9

  wpForo Forum <= 2.4.9 - Authenticated (Susbscriber+) SQL Injection

  Orta 6.5

• CVE-2025-0764abone+≤ 2.4.1

  wpForo Forum <= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in update

  Orta 6.5

• CVE-2024-3200katılımcı+≤ 2.3.3

  wpForo Forum <= 2.3.3 - Authenticated (Contributor+) SQL Injection

  Orta 6.5

• CVE-2026-93747abone+≤ 3.1.6

  wpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field

  Orta 6.4

• CVE-2026-15021abone+≤ 3.1.1

  wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field

  Orta 6.4

• CVE-2018-11709kimlik doğrulamasız · tıklama gerekir

  wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected

  Orta 6.1

• CVE-2022-40632kimlik doğrulamasız · tıklama gerekir≤ 2.0.5

  WordPress wpForo Forum plugin <= 2.0.5 - Cross-Site Request Forgery (CSRF) vulnerability

  Orta 5.4

• CVE-2025-4406abone+≤ 2.4.5

  wpForo Forum <= 2.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar

  Orta 5.4

• CVE-2023-47869giriş gerekir≤ 2.2.5

  WordPress wpForo plugin <= 2.2.5 - Broken Access Control + CSRF vulnerability

  Orta 5.4

• CVE-2022-38055giriş gerekir≤ 2.0.9

  WordPress wpForo Forum plugin <= 2.0.9 - Auth. HTML Injection vulnerability

  Orta 5.4

• CVE-2023-47872giriş gerekir≤ 2.2.3

  WordPress wpForo Forum Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS)

  Orta 5.4

• CVE-2026-28556giriş gerekir→ 2.4.16

  wpForo Forum 2.4.14 Missing Authorization via Topic Management Form Handlers

  Orta 5.3

• CVE-2026-28555giriş gerekir→ 2.4.16

  wpForo Forum 2.4.14 Missing Authorization via Topic Close AJAX Handler

  Orta 5.3

• CVE-2026-28554giriş gerekir→ 2.4.16

  wpForo Forum 2.4.14 Missing Authorization via Post Approval AJAX Handler

  Orta 5.3

• CVE-2026-28558giriş gerekir→ 2.4.16

  wpForo Forum 2.4.14 Stored XSS via SVG Avatar File Upload

  Orta 5.1

• CVE-2026-28561yüksek yetki→ 2.4.16

  wpForo Forum 2.4.14 Stored XSS via Unescaped Forum Description in Templates

  Orta 4.8

• CVE-2026-28560yüksek yetki→ 2.4.16

  wpForo Forum 2.4.14 Stored XSS via Unsafe JSON Encoding in Inline Script

  Orta 4.8

• CVE-2026-91092abone+≤ 3.1.5

  wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cooki

  Orta 4.3

• CVE-2025-58597giriş gerekir≤ 2.4.6

  WordPress wpForo Forum Plugin <= 2.4.6 - Insecure Direct Object References (IDOR) Vulnerability

  Orta 4.3

• CVE-2022-40206abone+≤ 2.0.5

  WordPress wpForo Forum plugin <= 2.0.5 - Insecure direct object references (IDOR) vulnerability

  Orta 4.3

• CVE-2022-40205abone+≤ 2.0.5

  WordPress wpForo Forum plugin <= 2.0.5 - Insecure direct object references (IDOR) vulnerability

  Orta 4.3