PatchTheCVE: vanilla forumshttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2010-4266: It was found in vanilla forums before 2.0.10 a potential linkbait vulnerability in dispatcher.https://patchthecve.com/cve/CVE-2010-4266.htmlhttps://patchthecve.com/cve/CVE-2010-4266.htmlTue, 16 Jun 2026 23:24:28 +0000MEDIUM 6.1: It was found in vanilla forums before 2.0.10 a potential linkbait vulnerability in dispatcher.CVE-2010-4264: It was found in vanilla forums before 2.0.10 a cross-site scripting vulnerability where a filename could contahttps://patchthecve.com/cve/CVE-2010-4264.htmlhttps://patchthecve.com/cve/CVE-2010-4264.htmlTue, 16 Jun 2026 23:24:28 +0000MEDIUM 6.1: It was found in vanilla forums before 2.0.10 a cross-site scripting vulnerability where a filename could contain arbitrary code to execute on the client side.CVE-2019-8279: Multiple stored XSS in Vanilla Forums before 2.5 allow remote attackers to inject arbitrary JavaScript code inhttps://patchthecve.com/cve/CVE-2019-8279.htmlhttps://patchthecve.com/cve/CVE-2019-8279.htmlWed, 17 Jun 2026 02:41:48 +0000MEDIUM 5.4: Multiple stored XSS in Vanilla Forums before 2.5 allow remote attackers to inject arbitrary JavaScript code into any message on forum.CVE-2018-15833: In Vanilla before 2.6.1, the polling functionality allows Insecure Direct Object Reference (IDOR) via the Pollhttps://patchthecve.com/cve/CVE-2018-15833.htmlhttps://patchthecve.com/cve/CVE-2018-15833.htmlWed, 17 Jun 2026 01:43:10 +0000MEDIUM 4.3: In Vanilla before 2.6.1, the polling functionality allows Insecure Direct Object Reference (IDOR) via the Poll ID, leading to the ability of a single user to select multiple Poll Options (e.g., vote for multiple items).CVE-2017-1000432: Vanilla Forums below 2.1.5 are affected by CSRF leading to Deleting topics and comments from forums Admin accehttps://patchthecve.com/cve/CVE-2017-1000432.htmlhttps://patchthecve.com/cve/CVE-2017-1000432.htmlWed, 17 Jun 2026 00:59:10 +0000HIGH 8.0: Vanilla Forums below 2.1.5 are affected by CSRF leading to Deleting topics and comments from forums Admin accessCVE-2014-9685: Multiple cross-site scripting (XSS) vulnerabilities in Vanilla Forums before 2.0.18.13 and 2.1.x before 2.1.1 https://patchthecve.com/cve/CVE-2014-9685.htmlhttps://patchthecve.com/cve/CVE-2014-9685.htmlWed, 17 Jun 2026 00:18:48 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in Vanilla Forums before 2.0.18.13 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2012-4954: The edit-profile page in Vanilla Forums before 2.1a32 allows remote authenticated users to modify arbitrary prhttps://patchthecve.com/cve/CVE-2012-4954.htmlhttps://patchthecve.com/cve/CVE-2012-4954.htmlTue, 16 Jun 2026 23:45:57 +0000LOW 3.5: The edit-profile page in Vanilla Forums before 2.1a32 allows remote authenticated users to modify arbitrary profile settings by replacing the UserID value during a man-in-the-middle attack, related to a "parameter manipulation" issue.