Gvectors Wpforo — known CVE vulnerabilities

Every CVE whose affected-product data names Gvectors Wpforo, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (5)

• CVE-2018-11515 — CVSS 9.8 (critical): The wpForo plugin through 2018-02-05 for WordPress has SQL Injection via a search with the /forum/ wpfo parameter.
• CVE-2019-19109 — CVSS 8.8 (high): The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF.
• CVE-2019-19111 — CVSS 6.1 (medium): The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter.
• CVE-2019-19112 — CVSS 6.1 (medium): The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php.
• CVE-2019-19110 — CVSS 4.8 (medium): The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter.