Tomdever vulnerabilities
32 CVEs and advisories name Tomdever as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-120532wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Reply Body in Moderation Forms
- CVE-2026-95870wpForo Forum <= 3.2.1 - Unauthenticated SQL Injection via 'data' Parameter
- CVE-2026-119164wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Privilege Escalation to 'data[secondary_groupids]' CSV Parameter
- CVE-2026-119155wpForo Forum <= 3.2.2 - Unauthenticated SQL Injection via 'href[locale]' Parameter
- CVE-2026-110004wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal via 'theme' Parameter
- CVE-2026-93747wpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field
- CVE-2026-93772WordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-91092wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie
- CVE-2026-5097wpForo Forum <= 2.4.17 - Unauthenticated SQL Injection via 'referer' Parameter
- CVE-2026-15021wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field
- CVE-2026-57636WordPress wpForo Forum plugin <= 3.0.9 - SQL Injection vulnerability
- CVE-2026-49767WordPress wpForo Forum plugin <= 3.1.0 - Broken Authentication vulnerability
- CVE-2026-49769WordPress wpForo Forum plugin <= 3.1.0 - PHP Object Injection vulnerability
- CVE-2026-40798WordPress wpForo Forum plugin <= 3.0.4 - SQL Injection vulnerability
- CVE-2026-40767WordPress wpForo Forum plugin < 3.0.2 - Broken Access Control vulnerability
- CVE-2026-42682WordPress wpForo Forum plugin <= 3.0.6 - Broken Access Control vulnerability
- CVE-2026-6248wpForo Forum <= 3.0.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Custom Profile Field File Path
- CVE-2026-4666wpForo Forum <= 2.4.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter
- CVE-2026-5809wpForo Forum <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter
- CVE-2026-3666wpForo Forum <= 2.4.16 - Authenticated (Subscriber+) Arbitrary File Deletion via Post Body
- CVE-2026-1581wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection
- CVE-2026-0910wpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection
- CVE-2025-66070WordPress wpForo Forum plugin <= 2.4.10 - Broken Access Control vulnerability
- CVE-2025-13126wpForo Forum <= 2.4.12 - Unauthenticated SQL Injection
- CVE-2025-11740wpForo Forum <= 2.4.9 - Authenticated (Susbscriber+) SQL Injection
- CVE-2025-4203wpForo Forum <= 2.4.8 - Unauthenticated SQL Injection via get_members Function
- CVE-2025-58597WordPress wpForo Forum Plugin <= 2.4.6 - Insecure Direct Object References (IDOR) Vulnerability
- CVE-2025-4406wpForo Forum <= 2.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar
- CVE-2025-31420WordPress wpForo Forum plugin <= 2.4.2 - Privilege Escalation vulnerability
- CVE-2025-0764wpForo Forum <= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in update