WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in wpForo Forum

Number one WordPress forum plugin with AI features. Full-fledged forum solution with modern forum design. Community builder WordPress forum plugin.

48Reported vulnerabilities
9.8Highest CVSS score
3.1.5Latest version
20,000+Active installs

What to do now

Update wpForo Forum to 3.0.0 or later. 48 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 16, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2023-2249 High 8.8 60.8% 2.1.7 and earlier 2.1.8 June 9, 2023
CVE-2018-11515 Critical 9.8 1.7% Before 1.4.5 1.4.5 May 28, 2018
CVE-2019-19109 High 8.8 0.7% 1.6.5 to 1.6.5 (inclusive) 1.7.0 June 15, 2020
CVE-2018-16613 Critical 9.8 2.7% Before 1.5.2 1.5.2 June 19, 2019
CVE-2019-19112 Medium 6.1 0.9% 1.6.5 to 1.6.5 (inclusive) 1.7.0 June 15, 2020
CVE-2019-19111 Medium 6.1 0.9% 1.6.5 to 1.6.5 (inclusive) 1.7.0 June 15, 2020
CVE-2023-47868 Critical 9.8 0.5% 2.2.3 and earlier 2.2.4 November 20, 2023
CVE-2022-40200 High 8.8 0.9% 2.0.9 and earlier 2.1.0 November 17, 2022
CVE-2026-3666 High 8.8 0.4% 2.4.16 and earlier 2.4.17 April 3, 2026
CVE-2026-28562 High 8.8 0.4% 2.4.0 up to (but not including) 2.4.15 2.4.15 February 28, 2026
CVE-2026-0910 High 8.8 0.5% 0 to 2.4.13 (inclusive) 2.4.14 February 11, 2026
CVE-2025-31420 High 8.8 0.3% 2.4.3 and earlier 2.4.4 April 2, 2025
CVE-2022-40192 High 8.8 0.4% 2.0.9 and earlier 2.1.0 November 17, 2022
CVE-2022-38144 High 8.8 0.5% 2.0.5 and earlier 2.0.6 September 9, 2022
CVE-2019-19110 Medium 4.8 0.7% 1.6.5 to 1.6.5 (inclusive) 1.7.0 June 15, 2020
CVE-2026-6248 High 8.1 0.6% 0 to 3.0.5 (inclusive) 3.0.6 April 20, 2026
CVE-2026-49769 High 8.1 0.4% 3.1.0 and earlier 3.1.1 June 4, 2026
CVE-2026-1581 High 7.5 1.7% 0 to 2.4.14 (inclusive) 2.4.15 February 19, 2026
CVE-2026-5097 High 7.5 0.4% 0 to 2.4.17 (inclusive) 3.0.0 August 28, 2026
CVE-2026-40798 High 7.5 0.3% 3.0.4 and earlier 3.0.5 May 7, 2026
CVE-2025-13126 High 7.5 0.4% 0 to 2.4.12 (inclusive) 2.4.13 December 14, 2025
CVE-2025-4203 High 7.5 0.3% 0 to 2.4.8 (inclusive) 2.4.9 October 25, 2025
CVE-2018-11709 Medium 6.1 3.6% Before 1.4.12 1.4.12 June 4, 2018
CVE-2026-5809 High 7.1 0.5% 0 to 3.0.2 (inclusive) 3.0.3 April 11, 2026
CVE-2026-28557 High 7.1 0.3% 2.4.0 up to (but not including) 2.4.16 2.4.16 February 28, 2026
CVE-2026-15021 Medium 6.4 0.4% 0 to 3.1.1 (inclusive) 3.1.2 July 16, 2026
CVE-2026-57636 Medium 6.5 0.4% 3.0.9 and earlier 3.1.0 June 26, 2026
CVE-2026-4666 Medium 6.5 0.3% 0 to 2.4.16 (inclusive) 3.0.0 April 17, 2026
CVE-2025-11740 Medium 6.5 0.3% 0 to 2.4.9 (inclusive) 2.4.10 November 1, 2025
CVE-2025-0764 Medium 6.5 0.4% Before 2.4.2 2.4.2 February 28, 2025
CVE-2023-47872 Medium 6.4 0.4% 2.2.3 and earlier 2.2.4 November 20, 2023
CVE-2026-12696 Medium 6.4 0.1% 3.1.1 and earlier 3.1.2 July 20, 2026
CVE-2026-49767 Medium 5.3 0.5% 3.1.0 and earlier 3.1.1 June 4, 2026
CVE-2022-38055 Medium 5.4 0.3% 2.0.9 and earlier 2.1.0 December 7, 2022
CVE-2022-40632 Medium 5.4 0.3% 2.0.5 and earlier 2.0.6 November 8, 2022
CVE-2026-42682 Medium 5.3 0.3% 3.0.6 and earlier 3.0.7 May 18, 2026
CVE-2026-40767 Medium 5.3 0.3% Before 3.0.2 3.0.2 April 21, 2026
CVE-2025-66070 Medium 5.3 0.3% 2.4.10 and earlier 2.4.11 November 18, 2025
CVE-2025-4406 Medium 5.4 0.2% 0 to 2.4.5 (inclusive) 2.4.6 July 10, 2025
CVE-2024-43289 Medium 5.3 0.4% 2.3.4 and earlier 2.3.5 August 16, 2024
CVE-2022-40205 Medium 4.3 0.5% 2.0.5 and earlier 2.0.6 November 8, 2022
CVE-2026-12698 Medium 4.3 0.2% 3.1.2 and earlier 3.1.3 July 27, 2026
CVE-2026-12697 Medium 4.3 0.2% 3.1.1 and earlier 3.1.2 July 16, 2026
CVE-2025-58597 Medium 4.3 0.3% 2.4.6 and earlier 2.4.7 September 3, 2025
CVE-2024-43288 Medium 4.3 0.3% 2.3.4 and earlier 2.3.5 August 16, 2024
CVE-2023-47870 Medium 4.3 0.3% 2.2.8 and earlier 2.2.9 November 20, 2023
CVE-2023-47869 Medium 4.3 0.3% 2.2.5 and earlier 2.2.6 November 20, 2023
CVE-2022-40206 Medium 4.3 0.5% 2.0.5 and earlier 2.0.6 November 8, 2022

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.