BlackTreeCVE Intelligence
Official source evidencewordpress.orgVersioned article
Official source article · wordpress.org

wpForo Forum – WordPress plugin | WordPress.org

BlackTree keeps a versioned source snapshot and links it to relevant CVE reports. The publisher remains authoritative for product applicability, release details and installation guidance.

Read the official article ↗
Publisherwordpress.org
Article IDNo stable ID in source URL
Verified snapshot27 Sept 2026, 08:30 UTC
Linked CVEs15

Linked CVE reports

These are source relationships, not a claim that this article fixes every affected product or branch.

  • CVE-2026-28557wpForo Forum < 2.4.16 Privilege Escalation via Role Synchronization Handler
  • CVE-2026-28562wpForo Forum 2.4.14 SQL Injection via Topics ORDER BY Parameter
  • CVE-2026-28561wpForo Forum 2.4.14 Stored XSS via Unescaped Forum Description in Templates
  • CVE-2026-28560wpForo Forum 2.4.14 Stored XSS via Unsafe JSON Encoding in Inline Script
  • CVE-2026-28559wpForo Forum 2.4.14 Information Disclosure via Global RSS Feed
  • CVE-2026-28558wpForo Forum 2.4.14 Stored XSS via SVG Avatar File Upload
  • CVE-2026-28556wpForo Forum 2.4.14 Missing Authorization via Topic Management Form Handlers
  • CVE-2026-28555wpForo Forum 2.4.14 Missing Authorization via Topic Close AJAX Handler
  • CVE-2026-28554wpForo Forum 2.4.14 Missing Authorization via Post Approval AJAX Handler
  • CVE-2022-38144WordPress wpForo Forum plugin <= 2.0.5 - Cross-Site Request Forgery (CSRF) vulnerability
  • CVE-2022-40632WordPress wpForo Forum plugin <= 2.0.5 - Cross-Site Request Forgery (CSRF) vulnerability
  • CVE-2022-40206WordPress wpForo Forum plugin <= 2.0.5 - Insecure direct object references (IDOR) vulnerability
  • CVE-2022-40205WordPress wpForo Forum plugin <= 2.0.5 - Insecure direct object references (IDOR) vulnerability
  • CVE-2018-11709wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected Cross-Site Scripting (XSS) via the URI
  • CVE-2018-16613An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress

Source and provenance

Original title: wpForo Forum – WordPress plugin | WordPress.org. Captured 27 Sept 2026, 08:30 UTC. The stored article is used for enrichment and change detection; BlackTree does not republish the publisher's full text here.

Open the publisher's current version ↗