Wpforo Forum
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:wpforo_forum:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Wpforo Forum (ed04b731-c951-523a-a843-76c66d6f39d2) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-12698 |
vulnerable | 2026-09-16 04:32:51.576379 |
wpForo Forum < 3.1.3 - Subscriber+ Account Status and Reputation Manipulation via Profile Update Mass Assignment
The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing their own account, allowing users with a subscriber-level account to write administrator-controlled account-state and reputation fields on their own profile, including self-activating a pending or banned account and forging their forum reputation score.
Published: 2026-08-04T06:00:09.506Z
Updated: 2026-08-04T14:29:45.722Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12697 |
vulnerable | 2026-09-16 04:32:50.987337 |
wpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDOR
The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting user before deleting its messages, allowing users with a subscriber-level account to permanently delete the stored AI chat message history of any other user.
Published: 2026-07-31T06:00:11.681Z
Updated: 2026-07-31T16:47:17.952Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12696 |
vulnerable | 2026-09-16 04:32:50.898181 |
wpForo Forum < 3.1.2 - Subscriber+ Stored XSS via Profile Location Field
The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor who views the profile, including a logged-in administrator.
Published: 2026-08-01T06:00:11.818Z
Updated: 2026-08-03T18:53:06.351Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-2309 |
vulnerable | 2026-06-08 06:02:42.019386 |
wpForo Forum < 2.1.9 - Reflected Cross-Site Scripting
The wpForo Forum WordPress plugin before 2.1.9 does not escape some request parameters while in debug mode, leading to a Reflected Cross-Site Scripting vulnerability.
Published: 2023-07-24T10:20:23.546Z
Updated: 2024-10-24T15:02:54.084Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.