Vendor
Tomdever
32 known vulnerabilities.
Tomdever at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 5 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 3 | 0 |
| Aug 2026 | 1 | 0 |
| Jul 2026 | 1 | 0 |
| Jun 2026 | 6 | 4 |
| May 2026 | 0 | 0 |
| Apr 2026 | 4 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 2 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 2 | 0 |
| Nov 2025 | 1 | 0 |
| Oct 2025 | 1 | 0 |
| Sep 2025 | 1 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 1 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 1 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 1 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Products
32 results · Feed
-
Medium 6.4
wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Reply Body in Moderation Forms
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post[body]' parameter in all versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated …
-
High 7.5
wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Privilege Escalation to 'data[secondary_groupids]' CSV Parameter
The wpForo Forum plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.2 via the `data[secondary_groupids]` parameter of the `wpforo_action_profile_update` POST handler. This is due to a type-confusion flaw in th…
-
High 7.5
wpForo Forum <= 3.2.1 - Unauthenticated SQL Injection via 'data' Parameter
The wpForo Forum plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to, and including, 3.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQ…
-
High 7.5
wpForo Forum <= 3.2.2 - Unauthenticated SQL Injection via 'href[locale]' Parameter
The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'href[locale]' parameter in all versions up to, and including, 3.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the …
-
Medium 6.5
wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal via 'theme' Parameter
The wpForo Forum plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the theme_delete function in all versions up to, and including, 3.2.2 This makes it possible for authenticated attackers, with subscribe…
-
Medium 6.4
wpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'telegram' profile field in versions up to, and including, 3.1.6. This is due to insufficient input sanitization and output escaping in the profile_update action — the …
-
Medium 6.5
WordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in wpForo Forum <= 3.1.5 versions.
-
Medium 4.3
wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie
The wpForo Forum plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated …
-
High 7.5
wpForo Forum <= 2.4.17 - Unauthenticated SQL Injection via 'referer' Parameter
The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'referer' parameter in all versions up to, and including, 2.4.17. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi…
-
Medium 6.4
wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'location' Profile Field in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated at…
-
High 8.5
WordPress wpForo Forum plugin <= 3.0.9 - SQL Injection vulnerability
Contributor SQL Injection in wpForo Forum <= 3.0.9 versions.
-
Critical 9.8
WordPress wpForo Forum plugin <= 3.1.0 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions.
-
Critical 9.8
WordPress wpForo Forum plugin <= 3.1.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions.
-
Critical 9.3
WordPress wpForo Forum plugin <= 3.0.4 - SQL Injection vulnerability
Unauthenticated SQL Injection in wpForo Forum <= 3.0.4 versions.
-
High 7.5
WordPress wpForo Forum plugin < 3.0.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in wpForo Forum < 3.0.2 versions.
-
Critical 9.1
WordPress wpForo Forum plugin <= 3.0.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in Tomdever wpForo Forum allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects wpForo Forum: from n/a through 3.0.6.
-
High 8.1
wpForo Forum <= 3.0.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Custom Profile Field File Path
The wpForo Forum plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 3.0.5. This is due to two compounding flaws: the Members::update() method does not validate or restrict the value of file-type custom profile fields…
-
Medium 6.5
wpForo Forum <= 2.4.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter
The wpForo Forum plugin for WordPress is vulnerable to unauthorized modification of data due to the use of `extract($args, EXTR_OVERWRITE)` on user-controlled input in the `edit()` method of `classes/Posts.php` in all versions up to, and including, 2.4.16. Th…
-
High 7.1
wpForo Forum <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter
The wpForo Forum plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 3.0.2. This is due to a two-step logic flaw: the topic_add() and topic_edit() action handlers accept arbitrary user-supplied data[*] arrays from $_R…
-
High 8.8
wpForo Forum <= 2.4.16 - Authenticated (Subscriber+) Arbitrary File Deletion via Post Body
The wpForo Forum plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 2.4.16. This is due to a missing file name/path validation against path traversal sequences. This makes it possible for authenticated attacker…
-
High 7.5CVE-2026-1581 Public exploit
wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection
The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'wpfob' parameter in all versions up to, and including, 2.4.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi…
-
High 8.8
wpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection
The wpForo Forum plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.4.13 via deserialization of untrusted input in the 'wpforo_display_array_data' function. This makes it possible for authenticated attackers, wi…
-
High 7.5
WordPress wpForo Forum plugin <= 2.4.10 - Broken Access Control vulnerability
Missing Authorization vulnerability in Tomdever wpForo Forum wpforo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpForo Forum: from n/a through <= 2.4.10.
-
High 7.5
wpForo Forum <= 2.4.12 - Unauthenticated SQL Injection
The wpForo Forum plugin for WordPress is vulnerable to generic SQL Injection via the `post_args` and `topic_args` parameters in all versions up to, and including, 2.4.12 due to insufficient escaping on the user supplied parameter and lack of sufficient prepar…
-
Medium 6.5CVE-2025-11740 Public exploit
wpForo Forum <= 2.4.9 - Authenticated (Susbscriber+) SQL Injection
The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the Subscriptions Manager in all versions up to, and including, 2.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL q…
-
High 7.5
wpForo Forum <= 2.4.8 - Unauthenticated SQL Injection via get_members Function
The wpForo Forum plugin for WordPress is vulnerable to error‐based or time-based SQL Injection via the get_members() function in all versions up to, and including, 2.4.8 due to missing integer validation on the 'offset' and 'row_count' parameters. The functio…
-
Medium 4.3
WordPress wpForo Forum Plugin <= 2.4.6 - Insecure Direct Object References (IDOR) Vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in Tomdever wpForo Forum wpforo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpForo Forum: from n/a through <= 2.4.6.
-
Medium 5.4
wpForo Forum <= 2.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,…
-
High 7.6
WordPress wpForo Forum plugin <= 2.4.2 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in Tomdever wpForo Forum wpforo allows Privilege Escalation.This issue affects wpForo Forum: from n/a through <= 2.4.2.
-
Medium 6.5
wpForo Forum <= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in update
The wpForo Forum plugin for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'update' method of the 'Members' class in all versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with…
-
Critical 9.9
wpForo Forum <= 2.3.3 - Authenticated (Contributor+) SQL Injection
The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'slug' attribute of the 'wpforo' shortcode in all versions up to, and including, 2.3.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation …
-
High 8.8CVE-2023-2249 EPSS 61%
wpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents
The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deserialization in versions up to, and including, 2.1.7. This is due to the insecure use of file_get_contents without appropriate verification of …