CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38144 – WordPress wpForo Forum plugin <= 2.0.5 - Cross-Site Request Forgery (CSRF) vulnerability
https://notcve.org/view.php?id=CVE-2022-38144
08 Sep 2022 — Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 at WordPress. Una vulnerabilidad de tipo Cross-Site Request Forgery (CSRF) en el plugin wpForo Forum de gVectors Team versiones anteriores a 2.0.5 incluyéndola, en WordPress The wpForo Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.5. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated ... • https://patchstack.com/database/vulnerability/wpforo/wordpress-wpforo-forum-plugin-2-0-5-cross-site-request-forgery-csrf-vulnerability/_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-40632 – WordPress wpForo Forum plugin <= 2.0.5 - Cross-Site Request Forgery (CSRF) vulnerability
https://notcve.org/view.php?id=CVE-2022-40632
08 Sep 2022 — Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 on WordPress leading to topic deletion. Vulnerabilidad de Cross-Site Request Forgery (CSRF) en el complemento gVectors Team wpForo Forum de Wordpress en versiones <= 2.0.5, lo que lleva a la eliminación del tema. The wpForo Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.5. This is due to missing or incorrect nonce validation on various AJAX actions. T... • https://patchstack.com/database/vulnerability/wpforo/wordpress-wpforo-forum-plugin-2-0-5-cross-site-request-forgery-csrf-vulnerability-2?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 8%CPEs: 1EXPL: 1CVE-2021-24406 – wpForo Forum < 1.9.7 - Open Redirect
https://notcve.org/view.php?id=CVE-2021-24406
14 Jun 2021 — The wpForo Forum WordPress plugin before 1.9.7 did not validate the redirect_to parameter in the login form of the forum, leading to an open redirect issue after a successful login. Such issue could allow an attacker to induce a user to use a login URL redirecting to a website under their control and being a replica of the legitimate one, asking them to re-enter their credentials (which will then in the attacker hands) El plugin wpForo Forum de WordPress versiones anteriores a 1.9.7,[ no comprueba el paráme... • https://wpscan.com/vulnerability/a9284931-555b-4c96-86a3-09e1040b0388 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2019-19112 – wpForo Forum <= 1.6.5 - Cross-Site Scripting via wpf-dw-td-value class
https://notcve.org/view.php?id=CVE-2019-19112
04 May 2020 — The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php. El plugin wpForo versión 1.6.5 para WordPress, permite un ataque de tipo XSS involucrando la clase wpf-dw-td-value del archivo dashboard.php • https://twitter.com/Sh0ckFR/status/1257298443527053313 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2019-19111 – wpForo Forum <= 1.6.5 - Cross-Site Scripting via langid parameter
https://notcve.org/view.php?id=CVE-2019-19111
04 May 2020 — The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter. El plugin wpForo versión 1.6.5 para WordPress, permite un ataque de tipo XSS por medio del parámetro langid de wp-admin/admin.php?page=wpforo-expressions • https://twitter.com/Sh0ckFR/status/1257298443527053313 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-19110 – wpForo Forum <= 1.6.5 - Cross-Site Scripting via s parameter
https://notcve.org/view.php?id=CVE-2019-19110
04 May 2020 — The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter. El plugin wpForo versión 1.6.5 para WordPress, permite un ataque de tipo XSS por medio del parámetro s de wp-admin/admin.php?page=wpforo-expressions • https://twitter.com/Sh0ckFR/status/1257298443527053313 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-19109 – wpForo Forum <= 1.6.5 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2019-19109
04 May 2020 — The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF. El plugin wpForo versión 1.6.5 para WordPress, permite un ataque de tipo CSRF de wp-admin/admin.php?page=wpforo-usergroups • https://twitter.com/Sh0ckFR/status/1257298443527053313 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2018-16613 – wpForo < = 1.5.1 - Privilege Escalation
https://notcve.org/view.php?id=CVE-2018-16613
06 Sep 2018 — An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress. A registered forum is able to escalate privilege to the forum administrator without any form of user interaction. Se descubrió un problema en la función de actualización en el plugin wpForo Forum antes de 1.5.2 para WordPress. Un foro registrado puede escalar privilegios al administrador del foro sin ningún tipo de interacción del usuario. An issue was discovered in the update function in the wpForo Forum p... • https://github.com/9emin1/advisories • CWE-269: Improper Privilege Management •
CVSS: 6.1EPSS: 6%CPEs: 1EXPL: 0CVE-2018-11709 – wpForo Forum < 1.4.12 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2018-11709
01 Jun 2018 — wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected Cross-Site Scripting (XSS) via the URI. wpforo_get_request_uri en wpf-includes/functions.php en el plugin wpForo Forum en versiones anteriores a la 1.4.12 para WordPress permite Cross-Site Scripting (XSS) reflejado no autenticado mediante el URI. • https://blog.dewhurstsecurity.com/2018/06/01/wp-foro-wordpress-plugin-xss-vulnerability.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 2CVE-2018-11515 – wpForo Forum <= 1.4.12 - SQL Injection
https://notcve.org/view.php?id=CVE-2018-11515
27 May 2018 — The wpForo plugin through 2018-02-05 for WordPress has SQL Injection via a search with the /forum/ wpfo parameter. Se ha descubierto un problema en Moodle 3.x. Los estudiantes que enviaban tareas y las exportaban a portfolios podían descargar cualquier archivo Moodle cambiando la URL de descarga. The wpForo Forum plugin for WordPress is vulnerable to Blind SQL Injection via the ‘wpfo’ parameter in versions up to, and including, 1.4.12 due to insufficient escaping on the user supplied parameter and lack of s... • https://github.com/DediData/wpforo/issues/1 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •