Login Request a demo
WF
Product
wpForo Forum
by gVectors Team · last CVE Feb 28, 2026
15
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities15In the news0Timeline
Severity mix
Critical 1High 3Medium 11Low 0
Severity
All severities15Critical1High3Medium11Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add wpForo Forum to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-28562
9.8
0%
Feb 28
wpForo Forum 2.4.14 SQL Injection via Topics ORDER BY Parameter
Affected: 2.4 before 2.4.15
CVE-2023-47870
8.8
0%
Nov 30
WordPress wpForo Forum Plugin <= 2.2.6 is vulnerable to Broken Access Control and Cross Site Request Forgery (CSRF)
Affected: through 2.2.6
CVE-2024-43288
8.1
0%
Aug 18
WordPress wpForo Forum plugin <= 2.3.4 - Insecure Direct Object References (IDOR) vulnerability
Affected: through 2.3.4
CVE-2024-43289
7.5
0%
Aug 26
WordPress wpForo Forum plugin <= 2.3.4 - Unauthenticated Sensitive Data Exposure vulnerability
Affected: through 2.3.4
CVE-2026-28557
6.5
0%
Feb 28
wpForo Forum < 2.4.16 Privilege Escalation via Role Synchronization Handler
Affected: 2.4 before 2.4.16
CVE-2026-28558
5.4
0%
Feb 28
wpForo Forum 2.4.14 Stored XSS via SVG Avatar File Upload
Affected: 2.4 before 2.4.16
CVE-2026-28556
5.4
0%
Feb 28
wpForo Forum 2.4.14 Missing Authorization via Topic Management Form Handlers
Affected: 2.4 before 2.4.16
CVE-2023-47869
5.4
0%
Dec 9
WordPress wpForo plugin <= 2.2.5 - Broken Access Control + CSRF vulnerability
Affected: through 2.2.5
CVE-2022-38055
5.4
0%
Jun 21
WordPress wpForo Forum plugin <= 2.0.9 - Auth. HTML Injection vulnerability
Affected: through 2.0.9
CVE-2023-47872
5.4
0%
Nov 30
WordPress wpForo Forum Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS)
Affected: through 2.2.3
CVE-2026-28559
5.3
0%
Feb 28
wpForo Forum 2.4.14 Information Disclosure via Global RSS Feed
Affected: 2.4 before 2.4.16
CVE-2026-28561
4.8
0%
Feb 28
wpForo Forum 2.4.14 Stored XSS via Unescaped Forum Description in Templates
Affected: 2.4 before 2.4.16
CVE-2026-28560
4.8
0%
Feb 28
wpForo Forum 2.4.14 Stored XSS via Unsafe JSON Encoding in Inline Script
Affected: 2.4 before 2.4.16
CVE-2026-28555
4.3
0%
Feb 28
wpForo Forum 2.4.14 Missing Authorization via Topic Close AJAX Handler
Affected: 2.4 before 2.4.16
CVE-2026-28554
4.3
0%
Feb 28
wpForo Forum 2.4.14 Missing Authorization via Post Approval AJAX Handler
Affected: 2.4 before 2.4.16
Showing 15