WordPress wpforo has 16 known advisories in the phpwarden feed. Feed 2026.10.28.3, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2023-2249 | The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deserialization in versions | high | 8.8 | <=2.1.7 | – |
| CVE-2018-11709 | wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected | medium | 6.1 | <1.4.12 | 1.4.12 |
| CVE-2018-16613 | An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress. A registered forum is able to escalate | critical | 9.8 | <1.5.2 | 1.5.2 |
| CVE-2018-11515 | The wpForo plugin through 2018-02-05 for WordPress has SQL Injection via a search with the /forum/ wpfo parameter. | critical | 9.8 | <1.4.5 | 1.4.5 |
| CVE-2022-40200 | Auth. (subscriber+) Arbitrary File Upload vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress. | critical | 9.9 | <=2.0.9 | – |
| CVE-2019-19111 | The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter. | medium | 6.1 | =1.6.5 | – |
| CVE-2019-19112 | The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php. | medium | 6.1 | =1.6.5 | – |
| CVE-2019-19109 | The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF. | high | 8.8 | =1.6.5 | – |
| CVE-2019-19110 | The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter. | medium | 4.8 | =1.6.5 | – |
| CVE-2022-40205 | Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or | medium | 5.4 | <=2.0.5 | – |
| CVE-2022-40206 | Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or | medium | 6.3 | <=2.0.5 | – |
| CVE-2022-38144 | Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 at WordPress. | high | 8.8 | <=2.0.5 | – |
| CVE-2026-28562 | wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffectiv | high | 8.2 | >=2.4.0 and <2.4.15 | 2.4.15 |
| CVE-2025-0764 | The wpForo Forum plugin for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'update' method of th | medium | 6.5 | <2.4.2 | 2.4.2 |
| CVE-2026-28557 | wpForo Forum 2.4.14 contains a missing capability check vulnerability that allows authenticated users to trigger bulk wpForo usergroup reass | medium | 6.5 | >=2.4.0 and <2.4.16 | 2.4.16 |
| CVE-2022-40632 | Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 on WordPress leading to topic deletion. | medium | 5.4 | <=2.0.5 | – |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked