wpforo forum vulnerabilities and fixes

Recent CVEs affecting wpforo forum, with upgrade or downgrade steps. 16 tracked.

Also searched as: wpforoforum.

wpforo forum has 16 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 16. Most recent: 2026-02-28. Highest priority: CVE-2024-3200 (score 45/100).

• CVE-2026-28562 HIGH 8.2 UPGRADE wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER
• CVE-2026-28561 MEDIUM 5.5 UPGRADE wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows administrators to inject
• CVE-2026-28560 MEDIUM 5.5 UPGRADE wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via foru
• CVE-2026-28559 MEDIUM 5.3 UPGRADE wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retr
• CVE-2026-28558 MEDIUM 6.4 UPGRADE wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows authenticated subscribers
• CVE-2026-28557 MEDIUM 6.5 UPGRADE wpForo Forum 2.4.14 contains a missing capability check vulnerability that allows authenticated users to trigg
• CVE-2026-28556 MEDIUM 5.4 UPGRADE wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to mo
• CVE-2026-28555 MEDIUM 4.3 UPGRADE wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to cl
• CVE-2026-28554 MEDIUM 4.3 UPGRADE wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to ap
• CVE-2025-0764 MEDIUM 6.5 UPGRADE The wpForo Forum plugin for WordPress is vulnerable to arbitrary file read due to insufficient input validatio
• CVE-2024-43289 HIGH 7.5 UPGRADE Exposure of Sensitive Information to an Unauthorized Actor vulnerability in gVectors Team wpForo Forum.This is
• CVE-2024-43288 MEDIUM 4.3 UPGRADE Authorization Bypass Through User-Controlled Key vulnerability in gVectors Team wpForo Forum.This issue affect
• CVE-2024-3200 CRITICAL 9.9 UPGRADE The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'slug' attribute of the 'wpforo'
• CVE-2023-47869 MEDIUM 4.3 UPGRADE Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVectors Team w
• CVE-2023-47868 HIGH 7.3 UPGRADE Improper Privilege Management vulnerability in wpForo wpForo Forum allows Privilege Escalation.This issue affe
• CVE-2022-38055 MEDIUM 4.3 UPGRADE Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVectors Team w

FAQ

How do I fix wpforo forum vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is wpforo forum being exploited right now?

None of the tracked wpforo forum CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which wpforo forum CVE should I patch first?

CVE-2024-3200 currently ranks highest (45/100): The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'slug' attribute of the 'wpforo' .

RSS feed for wpforo forum · ← Back to latest CVEs