Vulnerabilities

TI-2019-13793 CVE-2019-19111 · GHSA-43f7-fp52-3g5h

The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter.

LOW 29

The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00934 Published 2020-06-15 No fix listed CWE-79

TI-2019-13792 CVE-2019-19110 · GHSA-w4vm-w3mj-jcv9

LOW 23

The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00709 Published 2020-06-15 No fix listed CWE-79

TI-2019-13791 CVE-2019-19109 · GHSA-prwr-m2jf-vx93

LOW 39

The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0071 Published 2020-06-15 No fix listed CWE-352

TI-2019-13794 CVE-2019-19112 · GHSA-435h-p97w-gq23

LOW 29

The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00934 Published 2020-06-15 No fix listed CWE-79

TI-2018-08234 CVE-2018-11515 · GHSA-2ph4-qcc6-cw8c

MEDIUM 45

The wpForo plugin through 2018-02-05 for WordPress has SQL Injection via a search with the /forum/ wpfo parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01594 Published 2018-05-28 No fix listed CWE-89