These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'location' Profile Field in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page [truncated]
CVE-2026-49767 is a critical vulnerability in the wpForo Forum plugin for WordPress, affecting versions up to and including 3.1.0. This vulnerability allows unauthenticated users to bypass authentication mechanisms, potentially leading to unauthorized access and control of the affected system. With a CVSS score of 9.8, this vulnerability is considered critical and requires immediate attention. The vulnera [truncated]
CVE-2026-49769 is a critical vulnerability in the wpForo Forum plugin for WordPress, affecting versions up to and including 3.1.0. This vulnerability allows unauthenticated attackers to inject PHP objects, potentially leading to remote code execution, among other impacts. The vulnerability has been assigned a CVSS score of 9.8, indicating a high severity level. The CVSS vector for this vulnerability is CV [truncated]
CVE-2026-40798 is a critical unauthenticated SQL injection vulnerability in the wpForo Forum plugin versions <= 3.0.4. The vulnerability has a CVSS score of 9.3 and was published on {cvePublishedAt}. The vulnerability was reported by Patchstack and is listed in the official CVE record {resourceLinkAnnotations.cve-org}.
CVE-2026-40767 is a HIGH severity vulnerability in the wpForo Forum plugin for WordPress. The vulnerability has a CVSS score of 7.5 and was published on 2026-06-15T21:16:49.353Z. The vulnerability allows unauthenticated broken access control in versions of the plugin before 3.0.2.
A critical missing authorization vulnerability in wpForo Forum allows unauthenticated attackers to exploit incorrectly configured access control security levels. The vulnerability affects versions from n/a through 3.0.6 and has been assigned a CVSS 3.1 score of 9.1 (Critical). The issue was published in the NVD on June 1, 2026, with a status of 'Received'. The underlying weakness is CWE-862 (Missing Autho [truncated]