Wpforo forum Vulnerabilities

This vulnerability allows an attacker to inject malicious JavaScript into a forum's description, which can then run whenever any user views that forum. It requires either a compromised admin account or a multisite setup where the attacker can modify the forum description.

This vulnerability allows an attacker to inject malicious scripts that can run in the browsers of all visitors to a wpForo forum. It occurs when an attacker manipulates the forum's URL by including certain characters, which lets them break out of the intended code and execute their own scripts.

This vulnerability allows attackers to access private and unapproved forum topics by exploiting the RSS feed feature, even if they are not logged in. It occurs when they request the feed without specifying a forum ID, which skips important privacy checks meant to protect that information.

This vulnerability allows an attacker to execute malicious code in the web browsers of users who view their profile page by uploading a specially crafted SVG file as their avatar. To exploit this, the attacker must be an authenticated subscriber on the wpForo Forum platform.

This vulnerability allows authenticated users, like regular subscribers, to move, merge, or split any forum topics without needing moderator permissions, potentially relocating sensitive discussions to private areas. To exploit this, the attacker must have a valid form nonce, which means they need to be logged into the forum.

This vulnerability allows authenticated users, like regular subscribers, to close or reopen any topic in the wpForo forum, disrupting discussions. It requires the attacker to submit a valid security token along with the topic ID, bypassing the usual permissions needed for moderators.

This vulnerability allows authenticated users, like subscribers, to approve or unapprove any forum post without proper permissions, effectively bypassing moderation controls. To exploit this, an attacker just needs to be logged in and submit a valid request with the post ID they want to manipulate.