# cve.now: Tomdever

The newest entries naming Tomdever as an affected vendor (up to 200), of 32 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-120532](https://cve.now/CVE-2026-120532.md): wpForo Forum \<= 3.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Reply Body in Moderation Forms (CVSS 6.4)
- [CVE-2026-95870](https://cve.now/CVE-2026-95870.md): wpForo Forum \<= 3.2.1 - Unauthenticated SQL Injection via 'data' Parameter (CVSS 7.5)
- [CVE-2026-119164](https://cve.now/CVE-2026-119164.md): wpForo Forum \<= 3.2.2 - Authenticated (Subscriber+) Privilege Escalation to 'data\[secondary\_groupids\]' CSV Parameter (CVSS 7.5)
- [CVE-2026-119155](https://cve.now/CVE-2026-119155.md): wpForo Forum \<= 3.2.2 - Unauthenticated SQL Injection via 'href\[locale\]' Parameter (CVSS 7.5)
- [CVE-2026-110004](https://cve.now/CVE-2026-110004.md): wpForo Forum \<= 3.2.2 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal via 'theme' Parameter (CVSS 6.5)
- [CVE-2026-93747](https://cve.now/CVE-2026-93747.md): wpForo Forum \<= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field (CVSS 6.4)
- [CVE-2026-93772](https://cve.now/CVE-2026-93772.md): WordPress wpForo Forum plugin \<= 3.1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-91092](https://cve.now/CVE-2026-91092.md): wpForo Forum \<= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo\_post\_edit Action / Forged comment\_author\_email Cookie (CVSS 4.3)
- [CVE-2026-5097](https://cve.now/CVE-2026-5097.md): wpForo Forum \<= 2.4.17 - Unauthenticated SQL Injection via 'referer' Parameter (CVSS 7.5)
- [CVE-2026-15021](https://cve.now/CVE-2026-15021.md): wpForo Forum \<= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field (CVSS 6.4)
- [CVE-2026-57636](https://cve.now/CVE-2026-57636.md): WordPress wpForo Forum plugin \<= 3.0.9 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-49767](https://cve.now/CVE-2026-49767.md): WordPress wpForo Forum plugin \<= 3.1.0 - Broken Authentication vulnerability (CVSS 9.8)
- [CVE-2026-49769](https://cve.now/CVE-2026-49769.md): WordPress wpForo Forum plugin \<= 3.1.0 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-40798](https://cve.now/CVE-2026-40798.md): WordPress wpForo Forum plugin \<= 3.0.4 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2026-40767](https://cve.now/CVE-2026-40767.md): WordPress wpForo Forum plugin \< 3.0.2 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-42682](https://cve.now/CVE-2026-42682.md): WordPress wpForo Forum plugin \<= 3.0.6 - Broken Access Control vulnerability (CVSS 9.1)
- [CVE-2026-6248](https://cve.now/CVE-2026-6248.md): wpForo Forum \<= 3.0.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Custom Profile Field File Path (CVSS 8.1)
- [CVE-2026-4666](https://cve.now/CVE-2026-4666.md): wpForo Forum \<= 2.4.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter (CVSS 6.5)
- [CVE-2026-5809](https://cve.now/CVE-2026-5809.md): wpForo Forum \<= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion via 'data\[body\]\[fileurl\]' Parameter (CVSS 7.1)
- [CVE-2026-3666](https://cve.now/CVE-2026-3666.md): wpForo Forum \<= 2.4.16 - Authenticated (Subscriber+) Arbitrary File Deletion via Post Body (CVSS 8.8)
- [CVE-2026-1581](https://cve.now/CVE-2026-1581.md): wpForo Forum \<= 2.4.14 - Unauthenticated Time-Based SQL Injection (CVSS 7.5)
- [CVE-2026-0910](https://cve.now/CVE-2026-0910.md): wpForo Forum \<= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection (CVSS 8.8)
- [CVE-2025-66070](https://cve.now/CVE-2025-66070.md): WordPress wpForo Forum plugin \<= 2.4.10 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2025-13126](https://cve.now/CVE-2025-13126.md): wpForo Forum \<= 2.4.12 - Unauthenticated SQL Injection (CVSS 7.5)
- [CVE-2025-11740](https://cve.now/CVE-2025-11740.md): wpForo Forum \<= 2.4.9 - Authenticated (Susbscriber+) SQL Injection (CVSS 6.5)
- [CVE-2025-4203](https://cve.now/CVE-2025-4203.md): wpForo Forum \<= 2.4.8 - Unauthenticated SQL Injection via get\_members Function (CVSS 7.5)
- [CVE-2025-58597](https://cve.now/CVE-2025-58597.md): WordPress wpForo Forum Plugin \<= 2.4.6 - Insecure Direct Object References (IDOR) Vulnerability (CVSS 4.3)
- [CVE-2025-4406](https://cve.now/CVE-2025-4406.md): wpForo Forum \<= 2.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar (CVSS 5.4)
- [CVE-2025-31420](https://cve.now/CVE-2025-31420.md): WordPress wpForo Forum plugin \<= 2.4.2 - Privilege Escalation vulnerability (CVSS 7.6)
- [CVE-2025-0764](https://cve.now/CVE-2025-0764.md): wpForo Forum \<= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in update (CVSS 6.5)
- [CVE-2024-3200](https://cve.now/CVE-2024-3200.md): wpForo Forum \<= 2.3.3 - Authenticated (Contributor+) SQL Injection (CVSS 9.9)
- [CVE-2023-2249](https://cve.now/CVE-2023-2249.md): wpForo Forum \<= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file\_get\_contents (CVSS 8.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/tomdever
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.