Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

8 records

Release: gVectors Team wpForo Forum 2.4.16 Clear all filters
TI-2026-22816 CVE-2026-28561 · GHSA-4595-c58r-mv75

wpForo Forum 2.4.14 Stored XSS via Unescaped Forum Description in Templates

Priority LOW 22

wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows administrators to inject persistent JavaScript via forum description fields echoed without output escaping across multiple theme templa…

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00265 Published 2026-02-28 Fixed in 2.4.16 CWE-79
TI-2026-22815 CVE-2026-28560 · GHSA-qv3m-qhpr-9vhh

wpForo Forum 2.4.14 Stored XSS via Unsafe JSON Encoding in Inline Script

Priority LOW 22

wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inline script block using json_encode without the JSON_HEX_TAG flag.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00265 Published 2026-02-28 Fixed in 2.4.16 CWE-79
TI-2026-22814 CVE-2026-28559 · GHSA-wwmc-gh3w-x32h

wpForo Forum 2.4.14 Information Disclosure via Global RSS Feed

Priority LOW 37

wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retrieve private and unapproved forum topics via the global RSS feed endpoint.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00391 Published 2026-02-28 Fixed in 2.4.16 CWE-200
TI-2026-22813 CVE-2026-28558 · GHSA-p235-gwp9-pfq6

wpForo Forum 2.4.14 Stored XSS via SVG Avatar File Upload

Priority LOW 23

wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows authenticated subscribers to upload SVG files as profile avatars through the avatar upload functionality.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00248 Published 2026-02-28 Fixed in 2.4.16 CWE-79
TI-2026-22812 CVE-2026-28557 · GHSA-gfm6-fcx7-chmc

wpForo Forum < 2.4.16 Privilege Escalation via Role Synchronization Handler

Priority LOW 33

wpForo Forum 2.4.14 contains a missing capability check vulnerability that allows authenticated users to trigger bulk wpForo usergroup reassignment via the wpforo_synch_roles AJAX handler.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00311 Published 2026-02-28 Fixed in 2.4.16 CWE-862
TI-2026-22811 CVE-2026-28556 · GHSA-rw6w-6q2w-c8g8

wpForo Forum 2.4.14 Missing Authorization via Topic Management Form Handlers

Priority LOW 24

wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to move, merge, or split any forum topic via the topic_move, topic_merge, and topic_split form action handlers.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0025 Published 2026-02-28 Fixed in 2.4.16 CWE-862
TI-2026-22810 CVE-2026-28555 · GHSA-p3gr-x272-xrcv

wpForo Forum 2.4.14 Missing Authorization via Topic Close AJAX Handler

Priority LOW 24

wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to close or reopen any forum topic via the wpforo_close_ajax handler.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00304 Published 2026-02-28 Fixed in 2.4.16 CWE-862
TI-2026-22809 CVE-2026-28554 · GHSA-57vv-vqrh-49wx

wpForo Forum 2.4.14 Missing Authorization via Post Approval AJAX Handler

Priority LOW 24

wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to approve or unapprove any forum post via the wpforo_approve_ajax AJAX handler.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00304 Published 2026-02-28 Fixed in 2.4.16 CWE-862