wpForo is the first AI powered forum plugin for WordPress. Full-fledged yet easy and light forum solution for your WordPress website. Comes with modern and responsive forum layouts and styles. This WordPress forum plugin brings everything you need to run an efficient and professional community. Powerful and beautiful forum with unique features. The best alternative to bbPress forum plugin.
5 Minute Forum Installation!
1. Activate plugin and find forums on /community/ page, (/community-2/ if /community/ is used),
2. Manage Forum Page, Title, etc in Dashboard > wpForo > Board > Edit Board admin page,
3. Manage Forums in Dashboard > wpForo > Forums admin page,
4. Manage Forum Menu in Dashboard > Appearance > Menu admin page,
5. Manage Forum Widgets in Dashboard > Appearance > Widgets admin page,
6. Manage Forum Colors in Dashboard > wpForo > Settings > Colors & Styles admin page, you can choose forum color styles.
Support Forum and Demo: https://wpforo.com/community/
Forum Documentation: https://wpforo.com/docs/wpforo-v3/
GDPR Compliance: https://wpforo.com/docs/wpforo-v3/gdpr/
Multi-layout WordPress Forum Plugin
- Extended Forum Layout
- Simplified Forum Layout
- Question and Answer Forum Layout
- Threaded Forum Layout
- Boxed Forum Layout
Migrate to wpForo
Free Migration Tool Go2wpForo: https://wpforo.com/docs/wpforo-v3/migrate-to-wpforo/
- Migrate bbPress forum to wpForo
- Migrate Asgaros forum to wpForo
- Migrate SimplePress forum to wpForo
- Migrate phpBB forum to wpForo
- Migrate SMF forum to wpForo
- Migrate Joomla Kunena forum to wpForo
- Migrate MyBB forum to wpForo
Forum Integration
wpForo forum plugin is well integrated with many Profile Builder and Paid Membership plugins, such as BuddyPress, Ultimate Members, WooCommerce Membership, Paid Memberships Pro, MemberPress, Groups and SureMembers plugins.
Forum Translation
wpForo is a WordPress forum plugin with all possibilities of plugin translation. We’d really appreciate if you could help translating wpForo forum plugin to your language here.
FORUM FEATURES
- 360° AI-Powered Features
- AI Semantic Search
- AI Topic Summarization
- AI Topic Suggestions
- AI Multi-Language Translation
- AI Chat Assistant
- AI Bot Reply & Suggest Reply
- AI Content Moderation
- AI Spam Detection
- AI Toxic Content Detection
- AI Tasks — Automated Topic Generation
- AI Tasks — Automated Reply Generation
- AI Tasks — Automated Topic Tag Moderation
- AI Analytics & Insights
- AI Knowledge Generation (RAG)
- AI Content Indexing – Text, Images, Documents
- Multi-board: Allows to have multiple separate forum pages
- Multi-language: Allows to forums with different languages
- Multi-layout: Four modern forum layouts (Q&A, Threaded…)
- Designed for small and extremely large forums/communities.
- Migrate from other forums using Go2wpForo tool.
- Four different forum layouts and designs.
- Six set of forum color styles including dark style.
- Super responsive forum on all kind of devices.
- Live user notification system
- Built-in forum SEO functions.
- Built-in forum Sitemap and Search Engine ping.
- Built-in forum Cache System.
- Built-in forum Antispam and Akismet integration.
- Advanced forum user profile system.
- Forum Member Rating and Badges.
- Built-in forum/topic subscription.
- Drag and Drop forum management system.
- Topic and Post front-end moderation.
- Forum topics and posts Read / Unread logging.
- Topic Tags and Tags Widget.
- Forum styles with different colors.
- Built-in, powerful forum Usergroup system.
- Forum Access sets per Usergroup per Forum.
- Forum Phrase System for quick translation.
- WordPress .MO/.PO translation files.
- Tools and options for GDPR Compliance
- Social Network Share Buttons
- BuddyPress Integration
- Ultimate Member Integration
Need more forum features?
Find wpForo forum plugin addons on gVectors Team website…
Use of 3rd Party Services
wpForo connects to external services operated by gVectors Team for certain features. These connections are optional and only active when the corresponding features are enabled by the forum administrator.
gVectors AI API (api.gvectors.com, api.gvectors.net)
When AI features are enabled by the forum administrator, wpForo sends forum content (topics, posts, and metadata) to the gVectors AI API for processing. This includes:
- Content Indexing: Forum content is sent to embedding generation for vector database
- Semantic Search: Query is sent for embedding for vector search
- AI Translation: Forum text is sent for translation into other languages
- AI Summarization: Topic content is sent for automatic summary generation
- Content Moderation: New posts are sent for AI-powered content analysis
- AI Chat: Conversation context is sent for AI response generation
- Topic Suggestions: Forum data is sent for generating related topic recommendations
No data is sent to the AI API unless the forum administrator explicitly enables AI features, accepts the Terms of Service and Privacy Policy, and configures an API key. A fallback domain (api.gvectors.net) may be used automatically if the primary domain is unreachable.
Terms of Service
Privacy Policy
gVectors Addons Store (gvectors.com)
When using wpForo addons purchased from the gVectors store, the plugin communicates with gvectors.com to verify addon licenses and deliver automatic updates through the WordPress Dashboard. This includes sending your site URL and license key to validate your purchase and check for available addon updates.
CVE History
| CVE | Published | CVSS v3 | CVSS v2 |
|---|---|---|---|
| 6.5 MEDIUM | — | ||
The wpForo Forum plugin for WordPress is vulnerable to unauthorized modification of data due to the use of `extract($args, EXTR_OVERWRITE)` on user-controlled input in the `edit()` method of `classes/Posts.php` in all versions up to, and including, 2.4.16. The `post_edit` action handler in `Actions.php` passes `$_REQUEST['post']` directly to `Posts::edit()`, which calls `extract($args, EXTR_OVERWRITE)`. An attacker can inject `post[guestposting]=1` to overwrite the local `$guestposting` variable, causing the entire permission check block to be skipped. The nonce check uses a hardcoded `wpforo_verify_form` action shared across all 8 forum templates, so any user who can view any forum page obtains a valid nonce. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit the title, body, name, and email fields of any forum post, including posts in private forums, admin posts, and moderator posts. Content passes through `wpforo_kses()` which strips JavaScript but allows rich HTML. | |||
| 5.5 MEDIUM | — | ||
wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inline script block using json_encode without the JSON_HEX_TAG flag. Attackers set a forum slug containing a closing script tag or unescaped single quote to break out of the JavaScript string context and execute arbitrary script in all visitors' browsers. | |||
| 5.5 MEDIUM | — | ||
wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows administrators to inject persistent JavaScript via forum description fields echoed without output escaping across multiple theme template files. On multisite installations or with a compromised admin account, attackers set a forum description containing HTML event handlers that execute when any user views the forum listing. | |||
| 8.2 HIGH | — | ||
wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payloads to perform blind boolean extraction of credentials from the WordPress database. | |||
| 4.3 MEDIUM | — | ||
wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to close or reopen any forum topic via the wpforo_close_ajax handler. Attackers submit a valid nonce with an arbitrary topic ID to bypass the moderator permission requirement and disrupt forum discussions. | |||
| 5.4 MEDIUM | — | ||
wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to move, merge, or split any forum topic via the topic_move, topic_merge, and topic_split form action handlers. Attackers with a valid form nonce can reorganize arbitrary forum content without moderator permissions, including relocating topics to private forums. | |||
| 6.5 MEDIUM | — | ||
wpForo Forum 2.4.14 contains a missing capability check vulnerability that allows authenticated users to trigger bulk wpForo usergroup reassignment via the wpforo_synch_roles AJAX handler. Attackers access the usergroups admin page, accessible to any authenticated user, to obtain a nonce, then remap all wpForo usergroups to arbitrary WordPress roles. | |||
| 6.4 MEDIUM | — | ||
wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows authenticated subscribers to upload SVG files as profile avatars through the avatar upload functionality. Attackers upload a crafted SVG containing CSS injection or JavaScript event handlers that execute in the browsers of any user who views the attacker's profile page. | |||
| 5.3 MEDIUM | — | ||
wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retrieve private and unapproved forum topics via the global RSS feed endpoint. Attackers request the RSS feed without a forum ID parameter, bypassing the privacy and status WHERE clauses that are only applied when a specific forum ID is present in the query. | |||
| 4.3 MEDIUM | — | ||
wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to approve or unapprove any forum post via the wpforo_approve_ajax AJAX handler. Attackers exploit the nonce-only check by submitting a valid nonce with an arbitrary post ID to bypass moderation controls entirely. | |||
| 7.5 HIGH | — | ||
The wpForo Forum plugin for WordPress is vulnerable to error‐based or time-based SQL Injection via the get_members() function in all versions up to, and including, 2.4.8 due to missing integer validation on the 'offset' and 'row_count' parameters. The function blindly interpolates 'row_count' into a 'LIMIT offset,row_count' clause using esc_sql() rather than enforcing numeric values. MySQL 5.x’s grammar allows a 'PROCEDURE ANALYSE' clause immediately after a LIMIT clause. Unauthenticated attackers controlling 'row_count' can append a stored‐procedure call, enabling error‐based or time‐based blind SQL injection that can be used to extract sensitive information from the database. | |||