wpForo Forum

81 Quality Score

Active Installs

19/30

With roughly 20,000 active installs, wpForo sits in a smaller niche than BuddyPress (100,000+) or bbPress, which is why its popularity score, weighted heavily on raw install counts, comes in at 64/30.

Update Freshness

25/25

The plugin was updated in early July 2026 and tests clean against WordPress 7.0.1, earning a perfect 100/25 maintenance score and signalling active development.

User Rating

14/15

390 users have rated it 94/100, indicating consistently high satisfaction among those who use it.

Support Health

8/15

Only 3 support threads exist in the tracked period, all resolved, which gives a 100% resolution rate but a low-confidence sample, reflected in the 50/15 score.

WP Compatibility

15/15

It supports WordPress 5.2 and PHP 7.1 minimums and has been validated against WordPress 7.0.1, earning a full 100/15 compatibility score.

Scores higher than 83% of indexed plugins

About

Number one WordPress forum plugin with AI features. Full-fledged forum solution with modern forum design. Community builder WordPress forum plugin.

Active Installs 20k+

Rating ★★★★½ 4.7/5

Last Updated 2026-09-26 7:53am GMT

Requires WordPress 5.2+

Tested Up To 7.1.2

Requires PHP 7.1+

Security History

51 known vulnerabilities, all patched

4 Critical 17 High 30 Medium

Most recent: September 24, 2026

View details ▸

wpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field Medium

September 24, 2026 Patched in ["3.1.7"] CVE-2026-93747

wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie Medium

September 21, 2026 Patched in ["3.1.6"] CVE-2026-91092

wpForo Forum <= 2.4.17 - Unauthenticated SQL Injection via 'referer' Parameter High

August 27, 2026 Patched in ["3.0.0"] CVE-2026-5097

wpForo Forum <= 3.1.2 - Missing Authorization to Authenticated (Subscriber+) Account Status Manipulation Medium

July 27, 2026 Patched in ["3.1.3"] CVE-2026-12698

wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting Medium

July 20, 2026 Patched in ["3.1.2"] CVE-2026-12696

wpForo Forum <= 3.1.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Chat Message Deletion Medium

July 16, 2026 Patched in ["3.1.2"] CVE-2026-12697

wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field Medium

July 15, 2026 Patched in ["3.1.2"] CVE-2026-15021

wpForo Forum <= 3.0.9 - Authenticated (Contributor+) SQL Injection Medium

June 26, 2026 Patched in ["3.1.0"] CVE-2026-57636

wpForo Forum <= 3.1.0 - Unauthenticated PHP Object Injection High

June 4, 2026 Patched in ["3.1.1"] CVE-2026-49769

wpForo Forum <= 3.1.0 - Missing Authorization Medium

June 4, 2026 Patched in ["3.1.1"] CVE-2026-49767

wpForo Forum <= 3.0.6 - Missing Authorization Medium

May 18, 2026 Patched in ["3.0.7"] CVE-2026-42682

wpForo Forum <= 3.0.4 - Unauthenticated SQL Injection High

May 7, 2026 Patched in ["3.0.5"] CVE-2026-40798

wpForo Forum < 3.0.2 - Missing Authorization Medium

April 21, 2026 Patched in ["3.0.2"] CVE-2026-40767

wpForo Forum <= 3.0.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Custom Profile Field File Path High

April 20, 2026 Patched in ["3.0.6"] CVE-2026-6248

wpForo Forum <= 2.4.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter Medium

April 16, 2026 Patched in ["3.0.0"] CVE-2026-4666

wpForo Forum <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter High

April 10, 2026 Patched in ["3.0.3"] CVE-2026-5809

wpForo Forum <= 2.4.16 - Authenticated (Subscriber+) Arbitrary File Deletion via Post Body High

April 3, 2026 Patched in ["2.4.17"] CVE-2026-3666

wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection High

February 18, 2026 Patched in ["2.4.15"] CVE-2026-1581

wpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection High

February 10, 2026 Patched in ["2.4.14"] CVE-2026-0910

wpForo Forum <= 2.4.12 - Unauthenticated SQL Injection High

December 13, 2025 Patched in ["2.4.13"] CVE-2025-13126

wpForo Forum <= 2.4.10 - Missing Authorization Medium

November 18, 2025 Patched in ["2.4.11"] CVE-2025-66070

wpForo Forum <= 2.4.9 - Authenticated (Susbscriber+) SQL Injection Medium

October 31, 2025 Patched in ["2.4.10"] CVE-2025-11740

wpForo Forum <= 2.4.8 - Unauthenticated SQL Injection via get_members Function High

October 24, 2025 Patched in ["2.4.9"] CVE-2025-4203

wpForo Forum <= 2.4.6 - Authenticated (Subscriber+) Insecure Direct Object Reference Medium

September 3, 2025 Patched in ["2.4.7"] CVE-2025-58597

wpForo Forum <= 2.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar Medium

July 9, 2025 Patched in ["2.4.6"] CVE-2025-4406

wpForo Forum <= 2.4.3 - Authenticated (Subscriber+) Privilege Escalation High

April 2, 2025 Patched in ["2.4.4"] CVE-2025-31420

wpForo Forum <= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in update Medium

February 27, 2025 Patched in ["2.4.2"] CVE-2025-0764

wpForo Forum <= 2.3.4 - Unauthenticated Sensitive Information Exposure Medium

August 16, 2024 Patched in ["2.3.5"] CVE-2024-43289

wpForo Forum <= 2.3.4 - Authenticated (Subscriber+) Insecure Direct Object Reference Medium

August 16, 2024 Patched in ["2.3.5"] CVE-2024-43288

wpForo Forum <= 2.3.3 - Authenticated (Contributor+) SQL Injection Critical

May 31, 2024 Patched in ["2.3.4"] CVE-2024-3200

wpForo Forum <= 2.2.3 - Unauthenticated Privilege Escalation Critical

November 20, 2023 Patched in ["2.2.4"] CVE-2023-47868

wpForo Forum <= 2.2.8 - Cross-Site Request Forgery via logout() Medium

November 20, 2023 Patched in ["2.2.9"] CVE-2023-47870

wpForo Forum <= 2.2.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting Medium

November 20, 2023 Patched in ["2.2.4"] CVE-2023-47872

wpForo Forum <= 2.2.5 - Missing Authorization Medium

November 20, 2023 Patched in ["2.2.6"] CVE-2023-47869

wpForo Forum <= 2.1.8 - Reflected Cross-Site Scripting via 'wpforo_debug' Medium

July 3, 2023 Patched in ["2.1.9"] CVE-2023-2309

wpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents High

June 1, 2023 Patched in ["2.1.8"] CVE-2023-2249

wpForo Forum <= 2.0.9 - Authenticated (Subscriber+) HTML Injection Medium

December 7, 2022 Patched in ["2.1.0"] CVE-2022-38055

wpForo Forum <= 2.0.5 - Insecure Direct Object Reference to Forum Privacy Change Medium

November 26, 2022 Patched in ["2.0.6"] CVE-2022-40206

wpForo Forum <= 2.0.9 - Authenticated (Subscriber+) Arbitrary File Upload High

November 9, 2022 Patched in ["2.1.0"] CVE-2022-40200

wpForo Forum <= 2.0.9 - Cross-Site Request Forgery High

November 9, 2022 Patched in ["2.1.0"] CVE-2022-40192

wpForo Forum <= 2.0.5 - Insecure Direct Object Reference to Forum Status Change Medium

September 26, 2022 Patched in ["2.0.6"] CVE-2022-40205

wpForo Forum <= 2.0.5 - Cross-Site Request Forgery High

September 8, 2022 Patched in ["2.0.6"] CVE-2022-38144

wpForo Forum <= 2.0.5 - Cross-Site Request Forgery High

September 8, 2022 Patched in ["2.0.6"] CVE-2022-40632

wpForo Forum <= 1.9.6 - Open Redirect Medium

June 14, 2021 Patched in ["1.9.7"] CVE-2021-24406

wpForo Forum <= 1.6.5 - Cross-Site Scripting via langid parameter Medium

May 4, 2020 Patched in ["1.7.0"] CVE-2019-19111

wpForo Forum <= 1.6.5 - Cross-Site Request Forgery High

May 4, 2020 Patched in ["1.7.0"] CVE-2019-19109

wpForo Forum <= 1.6.5 - Cross-Site Scripting via wpf-dw-td-value class Medium

May 4, 2020 Patched in ["1.7.0"] CVE-2019-19112

wpForo Forum <= 1.6.5 - Cross-Site Scripting via s parameter Medium

May 4, 2020 Patched in ["1.7.0"] CVE-2019-19110

wpForo < = 1.5.1 - Privilege Escalation Critical

September 6, 2018 Patched in ["1.5.2"] CVE-2018-16613

wpForo Forum < 1.4.12 - Reflected Cross-Site Scripting Medium

June 1, 2018 Patched in ["1.4.12"] CVE-2018-11709

wpForo Forum <= 1.4.12 - SQL Injection Critical

May 27, 2018 Patched in ["1.4.13"] CVE-2018-11515

What It Does

wpForo Forum transforms a WordPress site into a full community forum with threaded discussions, member profiles, and topic subscriptions. It ships with built-in AI features for content assistance and moderation, plus several modern forum design styles out of the box. It works as a self-contained community platform, so you do not need bbPress or BuddyPress to run a discussion site.

Who It's For

This plugin is a good fit for site owners who want a standalone forum experience on WordPress without stacking multiple community plugins. It suits niche communities, membership sites, and businesses that want AI-assisted moderation and a modern look without custom theme work. Developers who prefer deep CSS control will also appreciate its built-in styling system.

Who Should Skip It

If you already run bbPress or BuddyPress and are happy with that setup, migrating to wpForo adds little value and involves real effort. Sites expecting 100,000+ active forum users should look at purpose-built platforms like Discourse rather than a WordPress plugin.

The Bottom Line

wpForo Forum earns an 80.86/100 quality score, with a high overall rating and excellent maintenance record offset by a modest install base and limited support footprint. It is a solid choice for WordPress site owners who want a self-contained, modern forum with AI features and do not mind a smaller community of users. For very high-traffic communities or for those already invested in bbPress or BuddyPress, alternatives will serve you better.

Related Plugins

Ultimate Member 90/100

Choose Ultimate Member when your priority is user profiles, registration, and membership access control rather than forum discussions.

One User Avatar 84/100

Pick this lightweight option if you only need profile pictures and avatars for existing community plugins like BuddyPress or bbPress.

BuddyPress 82/100

Pick BuddyPress if you want a much larger ecosystem of add-ons, a bigger install base of around 100,000, and a more social-network-style community.

Content Aware Sidebars 80/100

Choose this when you need dynamic widget areas based on forum pages, not a full forum solution.

Asgaros Forum 80/100

Pick Asgaros Forum for a simpler, lighter forum plugin if you do not need wpForo's AI features and design options.