Plugin security history

wpForo Forum Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 45 vulnerability records associated with wpForo Forum, published between 2018 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

45Total records

4Critical

16High

25Medium

0Low

0Informational

45Patched records

0Currently marked unpatched

2018-05-27First disclosure

2026-07-15Latest disclosure

45 of 45CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2018	3	3 records
2020	4	4 records
2021	1	1 records
2022	7	7 records
2023	6	6 records
2024	3	3 records
2025	8	8 records
2026	13	13 records

Severity Breakdown

Severity	Records	Share
Critical	4	8.9%
High	16	35.6%
Medium	25	55.6%

Vulnerability-Type Breakdown

Missing Authorization

10 records22.2%

First: 2022. Latest: 2026.

SQL Injection

8 records17.8%

First: 2018. Latest: 2026.

Cross-Site Scripting

8 records17.8%

First: 2018. Latest: 2026.

Other

6 records13.3%

First: 2021. Latest: 2026.

CSRF

5 records11.1%

First: 2020. Latest: 2023.

Privilege Escalation

3 records6.7%

First: 2018. Latest: 2025.

Path Traversal

3 records6.7%

First: 2026. Latest: 2026.

Arbitrary File Upload

1 record2.2%

First: 2022. Latest: 2022.

Information Disclosure

1 record2.2%

First: 2024. Latest: 2024.

Patch Status

Patched: 45
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

3.1.2
3.1.0
3.1.1
3.0.7
3.0.5
3.0.2
3.0.6
3.0.0
3.0.3
2.4.17
2.4.15
2.4.14
2.4.13
2.4.11
2.4.10
2.4.9
2.4.7
2.4.6
2.4.4
2.4.2
2.3.5
2.3.4
2.2.6
2.2.9
2.2.4
2.1.9
2.1.8
2.1.0
2.0.6
1.9.7
1.7.0
1.5.2
1.4.12
1.4.13

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-2.2.3`	wpForo Forum <= 2.2.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting	November 20, 2023	2.2.4	Medium
`*-2.2.8`	wpForo Forum <= 2.2.8 - Cross-Site Request Forgery via logout()	November 20, 2023	2.2.9	Medium
`*-2.2.3`	wpForo Forum <= 2.2.3 - Unauthenticated Privilege Escalation	November 20, 2023	2.2.4	Critical
`*-2.1.8`	wpForo Forum <= 2.1.8 - Reflected Cross-Site Scripting via 'wpforo_debug'	July 3, 2023	2.1.9	Medium
`*-2.1.7`	wpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents	June 1, 2023	2.1.8	High
`*-2.0.9`	wpForo Forum <= 2.0.9 - Authenticated (Subscriber+) HTML Injection	December 7, 2022	2.1.0	Medium
`*-2.0.5`	wpForo Forum <= 2.0.5 - Insecure Direct Object Reference to Forum Privacy Change	November 26, 2022	2.0.6	Medium
`*-2.0.9`	wpForo Forum <= 2.0.9 - Cross-Site Request Forgery	November 9, 2022	2.1.0	High
`*-2.0.9`	wpForo Forum <= 2.0.9 - Authenticated (Subscriber+) Arbitrary File Upload	November 9, 2022	2.1.0	High
`*-2.0.5`	wpForo Forum <= 2.0.5 - Insecure Direct Object Reference to Forum Status Change	September 26, 2022	2.0.6	Medium
`*-2.0.5`	wpForo Forum <= 2.0.5 - Cross-Site Request Forgery	September 8, 2022	2.0.6	High
`*-2.0.5`	wpForo Forum <= 2.0.5 - Cross-Site Request Forgery	September 8, 2022	2.0.6	High
`*-1.9.6`	wpForo Forum <= 1.9.6 - Open Redirect	June 14, 2021	1.9.7	Medium
`*-1.6.5`	wpForo Forum <= 1.6.5 - Cross-Site Scripting via s parameter	May 4, 2020	1.7.0	Medium
`*-1.6.5`	wpForo Forum <= 1.6.5 - Cross-Site Scripting via wpf-dw-td-value class	May 4, 2020	1.7.0	Medium
`*-1.6.5`	wpForo Forum <= 1.6.5 - Cross-Site Request Forgery	May 4, 2020	1.7.0	High
`*-1.6.5`	wpForo Forum <= 1.6.5 - Cross-Site Scripting via langid parameter	May 4, 2020	1.7.0	Medium
`*-1.5.1`	wpForo < = 1.5.1 - Privilege Escalation	September 6, 2018	1.5.2	Critical
`[*, 1.4.12)`	wpForo Forum < 1.4.12 - Reflected Cross-Site Scripting	June 1, 2018	1.4.12	Medium
`*-1.4.12`	wpForo Forum <= 1.4.12 - SQL Injection	May 27, 2018	1.4.13	Critical

Selected source records

Latest Records

MediumCVE-2026-15021

wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field

Published: July 15, 2026

Affected versions: *-3.1.1
Patched versions: 3.1.2

Original Wordfence record

MediumCVE-2026-57636

wpForo Forum <= 3.0.9 - Authenticated (Contributor+) SQL Injection

Published: June 26, 2026

Affected versions: *-3.0.9
Patched versions: 3.1.0

Original Wordfence record

MediumCVE-2026-49767

wpForo Forum <= 3.1.0 - Missing Authorization

Published: June 4, 2026

Affected versions: *-3.1.0
Patched versions: 3.1.1

Original Wordfence record

HighCVE-2026-49769

wpForo Forum <= 3.1.0 - Unauthenticated PHP Object Injection

Published: June 4, 2026

Affected versions: *-3.1.0
Patched versions: 3.1.1

Original Wordfence record

MediumCVE-2026-42682

wpForo Forum <= 3.0.6 - Missing Authorization

Published: May 18, 2026

Affected versions: *-3.0.6
Patched versions: 3.0.7

Original Wordfence record

HighCVE-2026-40798

wpForo Forum <= 3.0.4 - Unauthenticated SQL Injection

Published: May 7, 2026

Affected versions: *-3.0.4
Patched versions: 3.0.5

Original Wordfence record

MediumCVE-2026-40767

wpForo Forum < 3.0.2 - Missing Authorization

Published: April 21, 2026

Affected versions: [*, 3.0.2)
Patched versions: 3.0.2

Original Wordfence record

HighCVE-2026-6248

wpForo Forum <= 3.0.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Custom Profile Field File Path

Published: April 20, 2026

Affected versions: *-3.0.5
Patched versions: 3.0.6

Original Wordfence record

Highest-Severity Records

CriticalCVE-2024-3200

wpForo Forum <= 2.3.3 - Authenticated (Contributor+) SQL Injection

Published: May 31, 2024

Affected versions: *-2.3.3
Patched versions: 2.3.4

Original Wordfence record

CriticalCVE-2023-47868

wpForo Forum <= 2.2.3 - Unauthenticated Privilege Escalation

Published: November 20, 2023

Affected versions: *-2.2.3
Patched versions: 2.2.4

Original Wordfence record

CriticalCVE-2018-16613

wpForo < = 1.5.1 - Privilege Escalation

Published: September 6, 2018

Affected versions: *-1.5.1
Patched versions: 1.5.2

Original Wordfence record

CriticalCVE-2018-11515

wpForo Forum <= 1.4.12 - SQL Injection

Published: May 27, 2018

Affected versions: *-1.4.12
Patched versions: 1.4.13

Original Wordfence record

HighCVE-2022-40200

wpForo Forum <= 2.0.9 - Authenticated (Subscriber+) Arbitrary File Upload

Published: November 9, 2022

Affected versions: *-2.0.9
Patched versions: 2.1.0

Original Wordfence record

HighCVE-2022-38144

wpForo Forum <= 2.0.5 - Cross-Site Request Forgery

Published: September 8, 2022

Affected versions: *-2.0.5
Patched versions: 2.0.6

Original Wordfence record

HighCVE-2019-19109

wpForo Forum <= 1.6.5 - Cross-Site Request Forgery

Published: May 4, 2020

Affected versions: *-1.6.5
Patched versions: 1.7.0

Original Wordfence record

HighCVE-2026-0910

wpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection

Published: February 10, 2026

Affected versions: *-2.4.13
Patched versions: 2.4.14

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory