CVE-2023-2309: vulnerability in wpForo Forum
wpForo Forum < 2.1.9 - Reflected Cross-Site Scripting
Published · Updated
18Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendepss 0.8%
exploitation probability
0.8%top 43% of all CVEs
observed exploitation
nono source reports it
The wpForo Forum WordPress plugin before 2.1.9 does not escape some request parameters while in debug mode, leading to a Reflected Cross-Site Scripting vulnerability.
Affected products
Unknown · wpForo ForumRelated CVEs — wpForo Forum
In the same product, most dangerous first.
CVE-2026-80513HIGHwpForo Forum < 3.1.6 - Subscriber+ PHP Object Injection via Profile FieldsEPSS 0.3%CVE-2026-12697MEDIUMwpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDOREPSS 0.3%CVE-2026-12698MEDIUMwpForo Forum < 3.1.3 - Subscriber+ Account Status and Reputation Manipulation via Profile Update Mass AssignmentEPSS 0.3%CVE-2026-12696MEDIUMwpForo Forum < 3.1.2 - Subscriber+ Stored XSS via Profile Location FieldEPSS 0.2%CVE-2026-80514MEDIUMwpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit BypassEPSS 0.2%