CVE-2018-11709

MEDIUM NUCLEI

wpForo Forum < 1.4.12 - Unauthenticated Reflected Cross-Site Scripting via URI

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2018-11709 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected Cross-Site Scripting (XSS) via the URI.

Nuclei Templates (1)

WordPress wpForo Forum <= 1.4.11 - Cross-Site Scripting
MEDIUMby daffainfo,s4e-io

References (3)

Core 3
Core References
Third Party Advisory x_refsource_misc
https://wpvulndb.com/vulnerabilities/9090
Release Notes x_refsource_misc
https://wordpress.org/plugins/wpforo/#developers

Scores

CVSS v3 6.1
EPSS 0.0363
EPSS Percentile 88.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
gvectors/wpforo_forum < 1.4.12
Published Jun 04, 2018
Tracked Since Feb 18, 2026