CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-19109 – wpForo Forum <= 1.6.5 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2019-19109
The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF. El plugin wpForo versión 1.6.5 para WordPress, permite un ataque de tipo CSRF de wp-admin/admin.php?page=wpforo-usergroups • https://twitter.com/Sh0ckFR/status/1257298443527053313 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2019-19111 – wpForo Forum <= 1.6.5 - Cross-Site Scripting via langid parameter
https://notcve.org/view.php?id=CVE-2019-19111
The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter. El plugin wpForo versión 1.6.5 para WordPress, permite un ataque de tipo XSS por medio del parámetro langid de wp-admin/admin.php?page=wpforo-expressions • https://twitter.com/Sh0ckFR/status/1257298443527053313 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-16613 – wpForo < = 1.5.1 - Privilege Escalation
https://notcve.org/view.php?id=CVE-2018-16613
An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress. A registered forum is able to escalate privilege to the forum administrator without any form of user interaction. Se descubrió un problema en la función de actualización en el plugin wpForo Forum antes de 1.5.2 para WordPress. Un foro registrado puede escalar privilegios al administrador del foro sin ningún tipo de interacción del usuario. An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress. • https://github.com/9emin1/advisories https://github.com/9emin1/advisories/blob/master/wpForo-1-5-1.md https://wordpress.org/plugins/wpforo/#developers • CWE-269: Improper Privilege Management •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-11709 – wpForo Forum < 1.4.12 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2018-11709
wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected Cross-Site Scripting (XSS) via the URI. wpforo_get_request_uri en wpf-includes/functions.php en el plugin wpForo Forum en versiones anteriores a la 1.4.12 para WordPress permite Cross-Site Scripting (XSS) reflejado no autenticado mediante el URI. • https://blog.dewhurstsecurity.com/2018/06/01/wp-foro-wordpress-plugin-xss-vulnerability.html https://wordpress.org/plugins/wpforo/#developers https://wpvulndb.com/vulnerabilities/9090 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 2CVE-2018-11515 – wpForo Forum <= 1.4.12 - SQL Injection
https://notcve.org/view.php?id=CVE-2018-11515
The wpForo plugin through 2018-02-05 for WordPress has SQL Injection via a search with the /forum/ wpfo parameter. Se ha descubierto un problema en Moodle 3.x. Los estudiantes que enviaban tareas y las exportaban a portfolios podían descargar cualquier archivo Moodle cambiando la URL de descarga. The wpForo Forum plugin for WordPress is vulnerable to Blind SQL Injection via the ‘wpfo’ parameter in versions up to, and including, 1.4.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. • https://github.com/DediData/wpforo/issues/1 https://wpvulndb.com/vulnerabilities/9089 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •