Gvectors Wpforo Forum vulnerabilities

CVE-2026-28555 [MEDIUM] CWE-862 CVE-2026-28555: wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscri wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to close or reopen any forum topic via the wpforo_close_ajax handler. Attackers submit a valid nonce with an arbitrary topic ID to bypass the moderator permission requirement and disrupt forum discussions.

CVE-2023-47869 [MEDIUM] CWE-80 CVE-2023-47869: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVect Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVectors Team wpForo Forum allows Code Injection.This issue affects wpForo Forum: from n/a through 2.2.5.

CVE-2022-38055 [MEDIUM] CWE-80 CVE-2022-38055: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVect Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVectors Team wpForo Forum allows Content Spoofing.This issue affects wpForo Forum: from n/a through 2.0.9.

CVE-2023-47872 [MEDIUM] CWE-79 CVE-2023-47872: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gVectors Team wpForo Forum allows Stored XSS.This issue affects wpForo Forum: from n/a through 2.2.3.

CVE-2026-28560 [MEDIUM] CWE-79 CVE-2026-28560: wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injectio wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inline script block using json_encode without the JSON_HEX_TAG flag. Attackers set a forum slug containing a closing script tag or unescaped single quote to break out of the JavaScript string context and execute arbi

CVE-2022-40632 [MEDIUM] CWE-352 CVE-2022-40632: Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 on Wor Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 on WordPress leading to topic deletion.

CVE-2026-28561 [MEDIUM] CWE-79 CVE-2026-28561: wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows administrators wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows administrators to inject persistent JavaScript via forum description fields echoed without output escaping across multiple theme template files. On multisite installations or with a compromised admin account, attackers set a forum description containing HTML event han

CVE-2022-40205 [MEDIUM] CWE-639 CVE-2022-40205: Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPr Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as solved/unsolved.

CVE-2022-40206 [MEDIUM] CWE-639 CVE-2022-40206: Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPr Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as private/public.