Read the docs

Asgaros

Records13All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9

Exploited now

Asgaros records in CISA KEV

No Asgaros vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Asgaros Forum 8 records HIGH

Records

13 records

TI-2023-05158 CVE-2023-5604 · GHSA-7862-qcxg-7h4c

Asgaros Forum < 2.7.1 - Unauthenticated Arbitrary File Upload

Priority HIGH 82

The Asgaros Forum WordPress plugin before 2.7.1 allows forum administrators, who may not be WordPress (super-)administrators, to set insecure configuration that allows unauthenticated users to upload dangerous files (e.g…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01964 Published 2023-11-27 Fixed in 2.7.1 CWE-434
TI-2021-07109 CVE-2021-24827 · GHSA-65r7-qmhv-jjr3

Asgaros Forum < 1.15.13 - Unauthenticated SQL Injection

Priority MEDIUM 56

The Asgaros Forum WordPress plugin before 1.15.13 does not validate and escape user input when subscribing to a topic before using it in a SQL statement, leading to an unauthenticated SQL injection issue

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.12559 Published 2021-11-08 Fixed in 1.15.13 CWE-89
TI-2025-10492 CVE-2025-11452 · GHSA-m598-vr3f-944r

Asgaros Forum <= 3.1.0 - Unauthenticated SQL Injection

Priority MEDIUM 42

The Asgaros Forum plugin for WordPress is vulnerable to SQL Injection via the '$_COOKIE['asgarosforum_unread_exclude']' cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01602 Published 2025-11-08 No fix listed CWE-89
TI-2022-00336 CVE-2022-0411 · GHSA-787f-w67j-6pv7

Asgaros Forum < 2.0.0 - Subscriber+ Blind SQL Injection

Priority MEDIUM 41

The Asgaros Forum WordPress plugin before 2.0.0 does not sanitise and escape the post_id parameter before using it in a SQL statement via a REST route of the plugin (accessible to any authenticated user), leading to a SQ…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01517 Published 2022-02-28 Fixed in 2.0.0 CWE-89
TI-2021-07323 CVE-2021-25045 · GHSA-g4j5-9jfg-qj9h

Asgaros Forum < 1.15.15 - Admin+ SQL Injection via forum_id

Priority LOW 35

The Asgaros Forum WordPress plugin before 1.15.15 does not validate or escape the forum_id parameter before using it in a SQL statement when editing a forum, leading to an SQL injection issue

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01502 Published 2022-01-24 Fixed in 1.15.15 CWE-89
TI-2025-26256 CVE-2025-39514 · GHSA-5vpj-4f48-j8qc

WordPress Asgaros Forum plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Asgaros Asgaros Forum asgaros-forum allows Stored XSS.This issue affects Asgaros Forum: from n/a through <= 3.2.1.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0036 Published 2025-04-16 No fix listed CWE-79
TI-2021-18781 CVE-2021-42365 · GHSA-8h56-96mw-r96r

Asgaros Forums <= 1.15.13 Authenticated Stored XSS

Priority LOW 23

The Asgaros Forums WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the name parameter found in the ~/admin/tables/admin-structure-table.php file which allowed attackers with…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.007 Published 2021-11-29 No fix listed CWE-79
TI-2026-69979 CVE-2026-39779 · GHSA-gc8x-g7gp-6x8w

Broken access control in Asgaros Forum WordPress plugin

Priority LOW 19

Missing Authorization vulnerability in Asgaros Asgaros Forum asgaros-forum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Asgaros Forum: from n/a through 3.4.0.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00162 Published 2026-10-09 No fix listed CWE-862
Open these records in search →