Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 70

Export CSV
CVE-2026-22204

wpDiscuz before 7.6.47 - Unsanitized Cookie Email Used as wp_mail() Recipient

wpDiscuz before 7.6.47 contains an email header injection vulnerability that allows attackers to manipulate mail recipients by injecting malicious data into the comment_author_email cookie. Attackers can craft a malicious cookie value that, when processed through urldecode() and passed to wp_mail() functions, enables header injection to alter email recipients or inject additional headers.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gvectors Wordpress
Products
Wpdiscuz Wordpress
CVE-2026-22210

wpDiscuz before 7.6.47 - Cross-Site Scripting via Unescaped Attachment URLs

wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through unescaped attachment URLs in HTML output by exploiting the WpdiscuzHelperUpload class. Attackers can craft malicious attachment records or filter hooks to inject arbitrary JavaScript into img and anchor tag attributes, executing code in the context of WordPress users viewing comments.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Gvectors Wordpress
Products
Wpdiscuz Wordpress
CVE-2026-22215

wpDiscuz before 7.6.47 - Missing CSRF Protection on wpdGetFollowsPage

wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability in the getFollowsPage() function that allows attackers to trigger unauthorized actions without nonce validation. Attackers can craft malicious requests to enumerate follow relationships and manipulate user follow data by exploiting the missing CSRF protection in the follows page handler.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gvectors Wordpress
Products
Wpdiscuz Wordpress
CVE-2026-22216

wpDiscuz before 7.6.47 - No Rate Limiting on Subscription Endpoints with LIKE Wildcard Bypass

wpDiscuz before 7.6.47 contains a missing rate limiting vulnerability that allows unauthenticated attackers to subscribe arbitrary email addresses to post notifications by sending POST requests to the wpdAddSubscription handler in class.WpdiscuzHelperAjax.php. Attackers can exploit LIKE wildcard characters in the subscription query to match multiple email addresses and generate unwanted notification emails to victim accounts.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Gvectors Wordpress
Products
Wpdiscuz Wordpress
CVE-2022-38144

WordPress wpForo Forum plugin <= 2.0.5 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 at WordPress.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Gvectors
Products
Wpforo Forum
CVE-2022-23984

WordPress wpDiscuz plugin <= 7.3.11 - Sensitive Information Disclosure

Sensitive information disclosure discovered in wpDiscuz WordPress plugin (versions <= 7.3.11).

CVSS 3.1 · 3.7 Low EPSS 1.1% KEV · Not listed
Vendors
Gvectors
Products
Wpdiscuz
CVE-2022-43492

WordPress Comments – wpDiscuz plugin 7.4.2 - Auth. Insecure Direct Object References (IDOR) vulnerability

Auth. (subscriber+) Insecure Direct Object References (IDOR) vulnerability in Comments – wpDiscuz plugin 7.4.2 on WordPress.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gvectors
Products
Wpdiscuz
CVE-2022-40206

WordPress wpForo Forum plugin <= 2.0.5 - Insecure direct object references (IDOR) vulnerability

Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as private/public.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gvectors
Products
Wpforo Forum
CVE-2022-40205

WordPress wpForo Forum plugin <= 2.0.5 - Insecure direct object references (IDOR) vulnerability

Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as solved/unsolved.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Gvectors
Products
Wpforo Forum
CVE-2022-40200

WordPress wpForo Forum plugin <= 2.0.9 - Auth. Arbitrary File Upload vulnerability

Auth. (subscriber+) Arbitrary File Upload vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Gvectors
Products
Wpforo Forum
CVE-2022-40632

WordPress wpForo Forum plugin <= 2.0.5 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 on WordPress leading to topic deletion.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Gvectors
Products
Wpforo Forum
CVE-2022-40192

WordPress wpForo Forum plugin <= 2.0.9 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Gvectors
Products
Wpforo Forum
CVE-2024-43289

WordPress wpForo Forum plugin <= 2.3.4 - Unauthenticated Sensitive Data Exposure vulnerability

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in gVectors Team wpForo Forum.This issue affects wpForo Forum: from n/a through 2.3.4.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Gvectors
Products
Wpforo Forum
CVE-2024-43288

WordPress wpForo Forum plugin <= 2.3.4 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in gVectors Team wpForo Forum.This issue affects wpForo Forum: from n/a through 2.3.4.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gvectors
Products
Wpforo Forum
CVE-2024-35681

WordPress wpDiscuz plugin <= 7.6.18 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in gVectors Team wpDiscuz allows Stored XSS.This issue affects wpDiscuz: from n/a through 7.6.18.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Gvectors
Products
Wpdiscuz
CVE-2023-47775

WordPress wpDiscuz Plugin <= 7.6.11 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team Comments — wpDiscuz plugin <= 7.6.11 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gvectors
Products
Wpdiscuz
CVE-2023-33213

WordPress wpView Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gVectors Display Custom Fields – wpView plugin <= 1.3.0 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Gvectors
Products
Wpview
CVE-2023-2309

wpForo Forum < 2.1.9 - Reflected Cross-Site Scripting

The wpForo Forum WordPress plugin before 2.1.9 does not escape some request parameters while in debug mode, leading to a Reflected Cross-Site Scripting vulnerability.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Gvectors
Products
Wpforo Forum
CVE-2021-24806

wpDiscuz < 7.3.4 - Arbitrary Comment Addition/Edition/Deletion via CSRF

The wpDiscuz WordPress plugin before 7.3.4 does check for CSRF when adding, editing and deleting comments, which could allow attacker to make logged in users such as admin edit and delete arbitrary comment, or the user who made the comment to edit it via a CSRF attack. Attackers could also make logged in users post arbitrary comment.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gvectors
Products
Wpdiscuz
CVE-2021-24737

Comments - wpDiscuz <= 7.3.0 - Admin+ Stored Cross-Site Scripting

The Comments – wpDiscuz WordPress plugin through 7.3.0 does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the page, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Gvectors
Products
Wpdiscuz