CVE-2026-22216 | Medium | 6.5 | 2026-03-13 | wpDiscuz before 7.6.47 contains a missing rate limiting vulnerability that allows unauthenticated attackers to subscribe arbitrary email addresses to post noti… |
CVE-2026-22215 | Medium | 4.3 | 2026-03-13 | wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability in the getFollowsPage() function that allows attackers to trigger unauthorized actio… |
CVE-2026-22210 | Medium | 4.4 | 2026-03-13 | wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through unescaped attachment URLs in HTML o… |
CVE-2026-22209 | Medium | 5.5 | 2026-03-13 | wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability in the customCss field that allows administrators to inject malicious scripts by breaking… |
CVE-2026-22204 | Low | 3.7 | 2026-03-13 | wpDiscuz before 7.6.47 contains an email header injection vulnerability that allows attackers to manipulate mail recipients by injecting malicious data into th… |
CVE-2026-22203 | Medium | 4.9 | 2026-03-13 | wpDiscuz before 7.6.47 contains an information disclosure vulnerability that allows administrators to inadvertently expose OAuth secrets by exporting plugin op… |
CVE-2026-22202 | High | 8.1 | 2026-03-13 | wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability that allows attackers to delete all comments associated with an email address by cra… |
CVE-2026-22201 | Medium | 5.3 | 2026-03-13 | wpDiscuz before 7.6.47 contains an IP spoofing vulnerability in the getIP() function that allows attackers to bypass IP-based rate limiting and ban enforcement… |
CVE-2026-22199 | High | 7.5 | 2026-03-13 | Voltronic Power SNMP Web Pro version 1.1 contains a pre-authentication path traversal vulnerability in the upload.cgi endpoint that allows unauthenticated atta… |
CVE-2026-22193 | High | 8.1 | 2026-03-13 | wpDiscuz before 7.6.47 contains an SQL injection vulnerability in the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL… |
CVE-2026-22192 | Critical | 9.9 | 2026-03-13 | Voltronic Power SNMP Web Pro version 1.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to access privileged management… |
CVE-2026-22191 | Medium | 5.2 | 2026-03-13 | Beghelli Sicuro24 SicuroWeb contains a template injection vulnerability that allows attackers to inject arbitrary AngularJS expressions by exploiting improper… |
CVE-2026-22183 | Medium | 6.1 | 2026-03-13 | wpDiscuz before 7.6.47 contains a stored cross-site scripting vulnerability in the inline comment preview functionality that allows authenticated users to inje… |
CVE-2026-22182 | High | 7.5 | 2026-03-13 | wpDiscuz before 7.6.47 contains an unauthenticated denial of service vulnerability that allows anonymous users to trigger mass notification emails by exploitin… |
CVE-2026-28562 | High | 8.2 | 2026-02-28 | wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitiz… |
CVE-2026-28561 | Medium | 5.5 | 2026-02-28 | wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows administrators to inject persistent JavaScript via forum description field… |
CVE-2026-28560 | Medium | 5.5 | 2026-02-28 | wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inline script block usi… |
CVE-2026-28559 | Medium | 5.3 | 2026-02-28 | wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retrieve private and unapproved forum topics via the… |
CVE-2026-28558 | Medium | 6.4 | 2026-02-28 | wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows authenticated subscribers to upload SVG files as profile avatars through t… |
CVE-2026-28557 | Medium | 6.5 | 2026-02-28 | wpForo Forum 2.4.14 contains a missing capability check vulnerability that allows authenticated users to trigger bulk wpForo usergroup reassignment via the wpf… |
CVE-2026-28556 | Medium | 5.4 | 2026-02-28 | wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to move, merge, or split any forum topic via the topic… |
CVE-2026-28555 | Medium | 4.3 | 2026-02-28 | wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to close or reopen any forum topic via the wpforo_clos… |
CVE-2026-28554 | Medium | 4.3 | 2026-02-28 | wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to approve or unapprove any forum post via the wpforo_… |
CVE-2025-4224 | High | 7.2 | 2025-06-03 | The wpForo + wpForo Advanced Attachments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via media upload names in all versions up to, and in… |
CVE-2025-0764 | Medium | 6.5 | 2025-02-28 | The wpForo Forum plugin for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'update' method of the 'Members' class i… |
CVE-2023-46309 | Medium | 5.3 | 2025-01-02 | Missing Authorization vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2023-45760 | Medium | 4.3 | 2025-01-02 | Missing Authorization vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2023-47869 | Medium | 4.3 | 2024-12-09 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVectors Team wpForo Forum allows Code Injection.This issue affe… |
CVE-2024-9488 | Critical | 9.8 | 2024-10-25 | The Comments – wpDiscuz plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.6.24. This is due to insufficient v… |
CVE-2024-43289 | High | 7.5 | 2024-08-26 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in gVectors Team wpForo Forum.This issue affects wpForo Forum: from n/a through 2.3.4. |
CVE-2024-43288 | Medium | 4.3 | 2024-08-18 | Authorization Bypass Through User-Controlled Key vulnerability in gVectors Team wpForo Forum.This issue affects wpForo Forum: from n/a through 2.3.4. |
CVE-2024-6704 | Medium | 5.3 | 2024-08-02 | The Comments – wpDiscuz plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 7.6.21. This is due to a lack of filtering o… |
CVE-2022-38055 | Medium | 4.3 | 2024-06-21 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVectors Team wpForo Forum allows Content Spoofing.This issue af… |
CVE-2024-35681 | Medium | 6.5 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in gVectors Team wpDiscuz allows Stored XSS.This issu… |
CVE-2023-46310 | Medium | 5.3 | 2024-06-04 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVectors Team wpDiscuz allows Code Injection.This issue affects… |
CVE-2024-3200 | Critical | 9.9 | 2024-06-01 | The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'slug' attribute of the 'wpforo' shortcode in all versions up to, and including, 2… |
CVE-2023-47868 | High | 7.3 | 2024-05-17 | Improper Privilege Management vulnerability in wpForo wpForo Forum allows Privilege Escalation.This issue affects wpForo Forum: from n/a through 2.2.3. |
CVE-2024-2477 | Medium | 6.4 | 2024-04-23 | The wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Alternative Text' field of an uploaded image in all versions up to, and… |
CVE-2023-51691 | Medium | 5.9 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gVectors Team Comments – wpDiscuz allows Stored XSS.This… |
CVE-2023-46311 | Low | 2.7 | 2023-12-20 | Authorization Bypass Through User-Controlled Key vulnerability in gVectors Team Comments – wpDiscuz.This issue affects Comments – wpDiscuz: from n/a through 7… |
CVE-2023-49759 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team WooDiscuz – WooCommerce Comments.This issue affects WooDiscuz – WooCommerce Comments: from n/a… |
CVE-2023-47870 | Medium | 5.7 | 2023-11-30 | Cross-Site Request Forgery (CSRF), Missing Authorization vulnerability in gVectors Team wpForo Forum wpforo allows Cross Site Request Forgery, Accessing Functi… |
CVE-2023-47872 | Medium | 6.5 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gVectors Team wpForo Forum allows Stored XSS.This issue a… |
CVE-2023-47775 | Medium | 4.3 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team Comments — wpDiscuz plugin <= 7.6.11 versions. |
CVE-2023-47185 | High | 7.1 | 2023-11-06 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in gVectors Team Comments — wpDiscuz plugin <= 7.6.11 versions. |
CVE-2023-3998 | Medium | 5.3 | 2023-10-20 | The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the userRate function in versions… |
CVE-2023-3869 | Medium | 5.3 | 2023-10-20 | The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the voteOnComment function in vers… |
CVE-2023-2309 | Medium | 6.1 | 2023-07-24 | The wpForo Forum WordPress plugin before 2.1.9 does not escape some request parameters while in debug mode, leading to a Reflected Cross-Site Scripting vulnera… |
CVE-2023-33213 | Medium | 5.9 | 2023-06-19 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gVectors Display Custom Fields – wpView plugin <= 1.3.0 versions. |
CVE-2023-2249 | High | 8.8 | 2023-06-09 | The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deserialization in versions up to, and includi… |
CVE-2023-33216 | Medium | 5.9 | 2023-05-28 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gVectors Team WooDiscuz – WooCommerce Comments woodiscuz-woocommerce-comments allows Stored X… |
CVE-2022-43492 | Medium | 4.3 | 2022-11-18 | Auth. (subscriber+) Insecure Direct Object References (IDOR) vulnerability in Comments – wpDiscuz plugin 7.4.2 on WordPress. |
CVE-2022-40200 | Critical | 9.9 | 2022-11-17 | Auth. (subscriber+) Arbitrary File Upload vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress. |
CVE-2022-40192 | High | 7.1 | 2022-11-17 | Cross-Site Request Forgery (CSRF) vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress. |
CVE-2022-40632 | Medium | 5.4 | 2022-11-08 | Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 on WordPress leading to topic deletion. |
CVE-2022-40206 | Medium | 6.3 | 2022-11-08 | Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or higher user roles t… |
CVE-2022-40205 | Medium | 5.4 | 2022-11-08 | Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or higher user roles t… |
CVE-2022-38144 | High | 8.8 | 2022-09-09 | Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 at WordPress. |
CVE-2022-23984 | Low | 3.7 | 2022-02-21 | Sensitive information disclosure discovered in wpDiscuz WordPress plugin (versions <= 7.3.11). |
CVE-2021-24806 | Medium | 4.3 | 2021-11-08 | The wpDiscuz WordPress plugin before 7.3.4 does check for CSRF when adding, editing and deleting comments, which could allow attacker to make logged in users s… |
CVE-2021-24737 | Medium | 4.8 | 2021-10-11 | The Comments – wpDiscuz WordPress plugin through 7.3.0 does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the page… |
CVE-2021-24406 | Medium | 6.1 | 2021-07-06 | The wpForo Forum WordPress plugin before 1.9.7 did not validate the redirect_to parameter in the login form of the forum, leading to an open redirect issue aft… |
CVE-2020-24186 | Critical | 10.0 | 2020-08-24 | A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any… |
CVE-2020-13640 | Critical | 9.8 | 2020-06-18 | A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order p… |
CVE-2019-19112 | Medium | 6.1 | 2020-06-15 | The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php. |
CVE-2019-19111 | Medium | 6.1 | 2020-06-15 | The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter. |
CVE-2019-19110 | Medium | 4.8 | 2020-06-15 | The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter. |
CVE-2019-19109 | High | 8.8 | 2020-06-15 | The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF. |
CVE-2018-16613 | Critical | 9.8 | 2019-06-19 | An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress. A registered forum is able to escalate privilege to the f… |
CVE-2018-11709 | Medium | 6.1 | 2018-06-04 | wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected Cross-Site Scripti… |
CVE-2018-11515 | Critical | 9.8 | 2018-05-28 | The wpForo plugin through 2018-02-05 for WordPress has SQL Injection via a search with the /forum/ wpfo parameter. |