gVectors Team

10 results · Clear filters · Feed

• High 8.1
  CVE-2026-22202

  wpDiscuz before 7.6.47 - Destructive GET Action Deletes All Comments by Email

  wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability that allows attackers to delete all comments associated with an email address by crafting a malicious GET request with a valid HMAC key. Attackers can embed the deletecomments action U…

  gVectors Team wpDiscuz
  Mar 13, 2026
• High 8.1
  CVE-2026-22193

  wpDiscuz before 7.6.47 - SQL Injection in getAllSubscriptions()

  wpDiscuz before 7.6.47 contains an SQL injection vulnerability in the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries. Attackers can inject malicious SQL code through email, activation_key, subscription_date, a…

  gVectors Team wpDiscuz
  Mar 13, 2026
• High 7.5
  CVE-2026-22182

  wpDiscuz before 7.6.47 - Unauthenticated Email Notification Flood via wpdCheckNotificationType

  wpDiscuz before 7.6.47 contains an unauthenticated denial of service vulnerability that allows anonymous users to trigger mass notification emails by exploiting the checkNotificationType() function. Attackers can repeatedly call the wpdiscuz-ajax.php endpoint…

  gVectors Team wpDiscuz
  Mar 13, 2026
• High 8.2
  CVE-2026-28562

  wpForo Forum 2.4.14 SQL Injection via Topics ORDER BY Parameter

  wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payloads to perf…

  gVectors Team wpForo Forum
  Feb 28, 2026
• High 7.2
  CVE-2025-4224

  wpForo + wpForo Advanced Attachments <= 3.1.3 - Unauthenticated Stored Cross-Site Scripting

  The wpForo + wpForo Advanced Attachments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via media upload names in all versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping. This makes it possible fo…

  gVectors Team wpForo + wpForo Advanced Attachments Web / CMS
  Jun 3, 2025
• High 7.5
  CVE-2024-43289

  WordPress wpForo Forum plugin <= 2.3.4 - Unauthenticated Sensitive Data Exposure vulnerability

  Exposure of Sensitive Information to an Unauthorized Actor vulnerability in gVectors Team wpForo Forum.This issue affects wpForo Forum: from n/a through 2.3.4.

  gVectors Team wpForo Forum
  Aug 26, 2024
• High 7.1
  CVE-2023-47870

  WordPress wpForo Forum Plugin <= 2.2.6 is vulnerable to Broken Access Control and Cross Site Request Forgery (CSRF)

  Cross-Site Request Forgery (CSRF), Missing Authorization vulnerability in gVectors Team wpForo Forum wpforo allows Cross Site Request Forgery, Accessing Functionality Not Properly Constrained by ACLs leading to forced all users log out.This issue affects wpFo…

  gVectors Team wpForo Forum
  Nov 30, 2023
• High 7.1
  CVE-2023-47185

  WordPress wpDiscuz Plugin <= 7.6.11 is vulnerable to Cross Site Scripting (XSS)

  Unauth. Stored Cross-Site Scripting (XSS) vulnerability in gVectors Team Comments — wpDiscuz plugin <= 7.6.11 versions.

  gVectors Team Comments — wpDiscuz
  Nov 6, 2023
• High 7.1
  CVE-2022-40192

  WordPress wpForo Forum plugin <= 2.0.9 - Cross-Site Request Forgery (CSRF) vulnerability

  Cross-Site Request Forgery (CSRF) vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress.

  gVectors Team wpForo Forum (WordPress plugin) Web / CMS
  Nov 17, 2022
• High 8.8
  CVE-2022-38144

  WordPress wpForo Forum plugin <= 2.0.5 - Cross-Site Request Forgery (CSRF) vulnerability

  Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 at WordPress.

  gVectors Team wpForo Forum (WordPress plugin) Web / CMS
  Sep 9, 2022