wpForo Forum

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

273 searches this plugin appeared in over the last 90 days, 20 listed. 226 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 4.2 years ago; the previous band took 2 years to cross, which places it about 50% of the way through.

1. ★★★★★ Ricsca2

   7mo ago

   The best forum for WordPress

   Read on wp.org ↗
2. ★★★★★ kuyawing

   8mo ago

   I’ve been using this forum plugin for 2 years now. It is simply the best forum software out there. The support forum is also amazing.There’s no other WordPress forum out there that is better than wpforo.

   Read on wp.org ↗
3. ★★★★★ abigaildcd

   9mo ago

   I really like this plugin. The learning curve is bearable and the support on their forum is excellent. The provided layout are great and if you must customizing them is not that hard. Read the documentation it actually will help you and if like me you get stuck on something because you don’t understand go to the user forum. My issue was so simple to solve I slapped my forehead to remind myself that sometimes even my own stupidity has no limits. The plugin is excellent. Thank you to the developers to really thinking this through.

   Read on wp.org ↗
4. ★★★★★ bbrian017

   10mo ago

   wpForo has exceeded my expectations as a WordPress forum plugin. The feature set is robust, well thought out, and powerful without being overwhelming. Most importantly, it worked seamlessly with my existing WordPress setup and integrated perfectly with my Divi theme right out of the box—no hacks or workarounds required. The plugin also tied cleanly into my pre-existing WordPress database, which made deployment smooth and worry-free. Performance has been solid, and the forum structure is flexible enough to support both simple discussions and more advanced community use cases. What really sets wpForo apart, though, is the support. I ran into two CSS issues that were beyond my skill level—I’m not a coder—and the support I received through the forums was excellent. The responses were friendly, accurate, and genuinely helpful, and the turnaround time was impressively fast. It’s rare to find a plugin that combines strong features, smooth theme compatibility, and responsive, high-quality support. wpForo delivers on all three. Highly recommended.

   Read on wp.org ↗
5. ★★★★★ Martin Sauter

   11mo ago

   wpForo is a feature-rich, highly configurable forum solution for free. Highly recommended!

   Read on wp.org ↗
6. ★★★★★ fufy

   1.3y ago

   This free plugin totally gives a lot. It provides everything needed to build a forum, one plugin and that’s all. Best plugin ever. This topic was modified 12 months ago by fufy.

   Read on wp.org ↗
7. ★★★★★ geddi2

   1.3y ago

   Any idea how to switch to German? Unfortunately, all my efforts have failed. I’ve placed the files wpforo-de_DE.po and wpforo-de_DE.mo in /languages/plugins/ – with no success. Switching to “Deutsch-Sie” or “Deutsch” didn’t help either. The author documentation page for translating WPForo shows “In progress” with a date of 2022.This all seems a bit too casual for a serious forum installation. So I guess I’ll have to look for something else. ———————– Irgendeine Idee, wie man auf Deutsch umstellt? Leider scheitern alle meine Bemühungen. Ich habe die Dateien wpforo-de_DE.po und wpforo-de_DE.mo in /languages/plugins/ abgelegt – ohne Erfolg. Auch das Umstellen auf “Deutsch-Sie” oder “Deutsch” halfen nicht. Die Autorendokumentationsseite zur Übersetzung von WPForo zeigt „In Bearbeitung“ mit einem Datum aus dem Jahr 2022 an.Das alles scheint mir etwas zu lässig für eine seriöse Foruminstallation. Also muss ich mich wohl nach etwas anderem umsehen.

   Read on wp.org ↗
8. ★★★★★ mikesafh

   1.4y ago

   I’m running this plugin on one, soon to be maybe two, non-profit websites, and needed a reasonable option to not have to keep using Facebook when people (especially those that like me don’t like Facebook) on the website wanted forum functionality. This fits the bill, and support for it has been outstanding when needed. There are so many features I haven’t even looked at too, but haven’t had to. Yet.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 3.1.2 Security: Fixed Stored XSS vulnerability in profile fields Security: Fixed IDOR vulnerability in AI Chat messaging Security: Fixed Mass Assignment vulnerability with privilege escalation via profile fields Added: Ultimat 3.1.2
2. — Version 3.1.1 Security: Fixed Broken Authentication vulnerability allowing administrator email mutation Security: Fixed PHP Object Injection vulnerability via widget AJAX handlers 3.1.1
3. — Version 3.1.0 Security: Fixed vulnerability issue in the Revisions module Security: Fixed vulnerability issue in Gutenberg block renderers New: Tools – Email Queue Tab, email notifications now sent asynchronously with automatic fallba 3.1.0
4. — Version 3.0.9 Fixed: AI Task “Topic Tag Manager” now runs asynchronously to avoid blocking topic creation Fixed: AI Content Moderation now correctly exempts admins and moderators from spam detection Fixed: AI Logs timezone display – t 3.0.9
5. — Version 3.0.8 Fixed: AI Chat WordPress content citations not displaying as clickable links Updated: New phrases to wpForo Phrase System Updated: Translation template (wpforo.pot) with AI feature phrases 3.0.8
6. — Version 3.0.7 Security: Fixed usergroup privilege escalation vulnerability during registration New: WordPress Indexing now has its own dedicated admin tab Fixed: AI Chatbot now respects “Bot Reply Unapproved” setting correctly Fixed: 3.0.7

All 54 disclosed vulnerabilities are patched in the current version (3.2.2). Sites still on an older version should update.

1. Patched Medium · 6.4 wpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field ↗
   2026-09-24 CVE-2026-93747 Improper Neutralization of Input During Web Page Generation Affects <= 3.1.6 Patched in 3.1.7
2. Patched Medium · 6.4 wpForo Forum <= 3.1.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
   2026-09-23 CVE-2026-93772 Improper Neutralization of Input During Web Page Generation Affects <= 3.1.5 Patched in 3.1.6
3. Patched High · 7.5 wpForo Forum <= 3.1.5 - Authenticated (Subscriber+) PHP Object Injection ↗
   2026-09-22 CVE-2026-80513 Deserialization of Untrusted Data Affects <= 3.1.5 Patched in 3.1.6
4. Patched Medium · 5.3 wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion ↗
   2026-09-22 CVE-2026-80514 Uncontrolled Resource Consumption Affects 3.0.0 - 3.1.5 Patched in 3.1.6
5. Patched Medium · 4.3 wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie ↗
   2026-09-21 CVE-2026-91092 Missing Authorization Affects <= 3.1.5 Patched in 3.1.6
6. Patched High · 7.5 wpForo Forum <= 2.4.17 - Unauthenticated SQL Injection via 'referer' Parameter ↗
   2026-08-27 CVE-2026-5097 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.4.17 Patched in 3.0.0
7. Patched Medium · 4.3 wpForo Forum <= 3.1.2 - Missing Authorization to Authenticated (Subscriber+) Account Status Manipulation ↗
   2026-07-27 CVE-2026-12698 Missing Authorization Affects <= 3.1.2 Patched in 3.1.3
8. Patched Medium · 6.4 wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
   2026-07-20 CVE-2026-12696 Improper Neutralization of Input During Web Page Generation Affects <= 3.1.1 Patched in 3.1.2
9. Patched Medium · 4.3 wpForo Forum <= 3.1.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Chat Message Deletion ↗
   2026-07-16 CVE-2026-12697 Authorization Bypass Through User-Controlled Key Affects <= 3.1.1 Patched in 3.1.2
10. Patched Medium · 6.4 wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field ↗
    2026-07-15 CVE-2026-15021 Improper Neutralization of Input During Web Page Generation Affects <= 3.1.1 Patched in 3.1.2
11. Patched Medium · 6.5 wpForo Forum <= 3.0.9 - Authenticated (Contributor+) SQL Injection ↗
    2026-06-26 CVE-2026-57636 Improper Neutralization of Special Elements used in an SQL Command Affects <= 3.0.9 Patched in 3.1.0
12. Patched Medium · 5.3 wpForo Forum <= 3.1.0 - Missing Authorization ↗
    2026-06-04 CVE-2026-49767 Missing Authorization Affects <= 3.1.0 Patched in 3.1.1
13. Patched High · 8.1 wpForo Forum <= 3.1.0 - Unauthenticated PHP Object Injection ↗
    2026-06-04 CVE-2026-49769 Deserialization of Untrusted Data Affects <= 3.1.0 Patched in 3.1.1
14. Patched Medium · 5.3 wpForo Forum <= 3.0.6 - Missing Authorization ↗
    2026-05-18 CVE-2026-42682 Missing Authorization Affects <= 3.0.6 Patched in 3.0.7
15. Patched High · 7.5 wpForo Forum <= 3.0.4 - Unauthenticated SQL Injection ↗
    2026-05-07 CVE-2026-40798 Improper Neutralization of Special Elements used in an SQL Command Affects <= 3.0.4 Patched in 3.0.5
16. Patched Medium · 5.3 wpForo Forum < 3.0.2 - Missing Authorization ↗
    2026-04-21 CVE-2026-40767 Missing Authorization Affects < 3.0.2 Patched in 3.0.2
17. Patched High · 8.1 wpForo Forum <= 3.0.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Custom Profile Field File Path ↗
    2026-04-20 CVE-2026-6248 Improper Limitation of a Pathname to a Restricted Directory Affects <= 3.0.5 Patched in 3.0.6
18. Patched Medium · 6.5 wpForo Forum <= 2.4.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter ↗
    2026-04-16 CVE-2026-4666 Missing Authorization Affects <= 2.4.16 Patched in 3.0.0
19. Patched High · 7.1 wpForo Forum <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter ↗
    2026-04-10 CVE-2026-5809 External Control of File Name or Path Affects <= 3.0.2 Patched in 3.0.3
20. Patched High · 8.8 wpForo Forum <= 2.4.16 - Authenticated (Subscriber+) Arbitrary File Deletion via Post Body ↗
    2026-04-03 CVE-2026-3666 Improper Limitation of a Pathname to a Restricted Directory Affects <= 2.4.16 Patched in 2.4.17
21. Patched High · 7.5 wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection ↗
    2026-02-18 CVE-2026-1581 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.4.14 Patched in 2.4.15
22. Patched High · 8.8 wpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection ↗
    2026-02-10 CVE-2026-0910 Deserialization of Untrusted Data Affects <= 2.4.13 Patched in 2.4.14
23. Patched High · 7.5 wpForo Forum <= 2.4.12 - Unauthenticated SQL Injection ↗
    2025-12-13 CVE-2025-13126 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.4.12 Patched in 2.4.13
24. Patched Medium · 5.3 wpForo Forum <= 2.4.10 - Missing Authorization ↗
    2025-11-18 CVE-2025-66070 Missing Authorization Affects <= 2.4.10 Patched in 2.4.11
25. Patched Medium · 6.5 wpForo Forum <= 2.4.9 - Authenticated (Susbscriber+) SQL Injection ↗
    2025-10-31 CVE-2025-11740 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.4.9 Patched in 2.4.10
26. Patched High · 7.5 wpForo Forum <= 2.4.8 - Unauthenticated SQL Injection via get_members Function ↗
    2025-10-24 CVE-2025-4203 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.4.8 Patched in 2.4.9
27. Patched Medium · 4.3 wpForo Forum <= 2.4.6 - Authenticated (Subscriber+) Insecure Direct Object Reference ↗
    2025-09-03 CVE-2025-58597 Authorization Bypass Through User-Controlled Key Affects <= 2.4.6 Patched in 2.4.7
28. Patched Medium · 5.4 wpForo Forum <= 2.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar ↗
    2025-07-09 CVE-2025-4406 Improper Neutralization of Input During Web Page Generation Affects <= 2.4.5 Patched in 2.4.6
29. Patched High · 8.8 wpForo Forum <= 2.4.3 - Authenticated (Subscriber+) Privilege Escalation ↗
    2025-04-02 CVE-2025-31420 Incorrect Privilege Assignment Affects <= 2.4.3 Patched in 2.4.4
30. Patched Medium · 6.5 wpForo Forum <= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in update ↗
    2025-02-27 CVE-2025-0764 Improper Input Validation Affects <= 2.4.1 Patched in 2.4.2
31. Patched Medium · 5.3 wpForo Forum <= 2.3.4 - Unauthenticated Sensitive Information Exposure ↗
    2024-08-16 CVE-2024-43289 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 2.3.4 Patched in 2.3.5
32. Patched Medium · 4.3 wpForo Forum <= 2.3.4 - Authenticated (Subscriber+) Insecure Direct Object Reference ↗
    2024-08-16 CVE-2024-43288 Authorization Bypass Through User-Controlled Key Affects <= 2.3.4 Patched in 2.3.5
33. Patched Critical · 9.9 wpForo Forum <= 2.3.3 - Authenticated (Contributor+) SQL Injection ↗
    2024-05-31 CVE-2024-3200 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.3.3 Patched in 2.3.4
34. Patched Critical · 9.8 wpForo Forum <= 2.2.3 - Unauthenticated Privilege Escalation ↗
    2023-11-20 CVE-2023-47868 Incorrect Privilege Assignment Affects <= 2.2.3 Patched in 2.2.4
35. Patched Medium · 4.3 wpForo Forum <= 2.2.8 - Cross-Site Request Forgery via logout() ↗
    2023-11-20 CVE-2023-47870 Cross-Site Request Forgery Affects <= 2.2.8 Patched in 2.2.9
36. Patched Medium · 6.4 wpForo Forum <= 2.2.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
    2023-11-20 CVE-2023-47872 Improper Neutralization of Input During Web Page Generation Affects <= 2.2.3 Patched in 2.2.4
37. Patched Medium · 4.3 wpForo Forum <= 2.2.5 - Missing Authorization ↗
    2023-11-20 CVE-2023-47869 Missing Authorization Affects <= 2.2.5 Patched in 2.2.6
38. Patched Medium · 6.1 wpForo Forum <= 2.1.8 - Reflected Cross-Site Scripting via 'wpforo_debug' ↗
    2023-07-03 CVE-2023-2309 Improper Neutralization of Input During Web Page Generation Affects <= 2.1.8 Patched in 2.1.9
39. Patched High · 8.8 wpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents ↗
    2023-06-01 CVE-2023-2249 Improper Control of Filename for Include/Require Statement in PHP Program Affects <= 2.1.7 Patched in 2.1.8
40. Patched Medium · 5.4 wpForo Forum <= 2.0.9 - Authenticated (Subscriber+) HTML Injection ↗
    2022-12-07 CVE-2022-38055 Improper Neutralization of Special Elements in Output Used by a Downstream Component Affects <= 2.0.9 Patched in 2.1.0
41. Patched Medium · 6.3 wpForo Forum <= 2.0.5 - Insecure Direct Object Reference to Forum Privacy Change ↗
    2022-11-26 CVE-2022-40206 Authorization Bypass Through User-Controlled Key Affects <= 2.0.5 Patched in 2.0.6
42. Patched High · 8.8 wpForo Forum <= 2.0.9 - Authenticated (Subscriber+) Arbitrary File Upload ↗
    2022-11-09 CVE-2022-40200 Unrestricted Upload of File with Dangerous Type Affects <= 2.0.9 Patched in 2.1.0
43. Patched High · 8.8 wpForo Forum <= 2.0.9 - Cross-Site Request Forgery ↗
    2022-11-09 CVE-2022-40192 Cross-Site Request Forgery Affects <= 2.0.9 Patched in 2.1.0
44. Patched Medium · 5.4 wpForo Forum <= 2.0.5 - Insecure Direct Object Reference to Forum Status Change ↗
    2022-09-26 CVE-2022-40205 Authorization Bypass Through User-Controlled Key Affects <= 2.0.5 Patched in 2.0.6
45. Patched High · 8.8 wpForo Forum <= 2.0.5 - Cross-Site Request Forgery ↗
    2022-09-08 CVE-2022-38144 Cross-Site Request Forgery Affects <= 2.0.5 Patched in 2.0.6
46. Patched High · 8.8 wpForo Forum <= 2.0.5 - Cross-Site Request Forgery ↗
    2022-09-08 CVE-2022-40632 Cross-Site Request Forgery Affects <= 2.0.5 Patched in 2.0.6
47. Patched Medium · 6.1 wpForo Forum <= 1.9.6 - Open Redirect ↗
    2021-06-14 CVE-2021-24406 URL Redirection to Untrusted Site Affects <= 1.9.6 Patched in 1.9.7
48. Patched Medium · 6.1 wpForo Forum <= 1.6.5 - Cross-Site Scripting via langid parameter ↗
    2020-05-04 CVE-2019-19111 Improper Neutralization of Input During Web Page Generation Affects <= 1.6.5 Patched in 1.7.0
49. Patched High · 8.8 wpForo Forum <= 1.6.5 - Cross-Site Request Forgery ↗
    2020-05-04 CVE-2019-19109 Cross-Site Request Forgery Affects <= 1.6.5 Patched in 1.7.0
50. Patched Medium · 6.1 wpForo Forum <= 1.6.5 - Cross-Site Scripting via wpf-dw-td-value class ↗
    2020-05-04 CVE-2019-19112 Improper Neutralization of Input During Web Page Generation Affects <= 1.6.5 Patched in 1.7.0
51. Patched Medium · 4.8 wpForo Forum <= 1.6.5 - Cross-Site Scripting via s parameter ↗
    2020-05-04 CVE-2019-19110 Improper Neutralization of Input During Web Page Generation Affects <= 1.6.5 Patched in 1.7.0
52. Patched Critical · 9.8 wpForo < = 1.5.1 - Privilege Escalation ↗
    2018-09-06 CVE-2018-16613 Improper Privilege Management Affects <= 1.5.1 Patched in 1.5.2
53. Patched Medium · 6.1 wpForo Forum < 1.4.12 - Reflected Cross-Site Scripting ↗
    2018-06-01 CVE-2018-11709 Improper Neutralization of Input During Web Page Generation Affects < 1.4.12 Patched in 1.4.12
54. Patched Critical · 9.8 wpForo Forum <= 1.4.12 - SQL Injection ↗
    2018-05-27 CVE-2018-11515 Improper Neutralization of Special Elements used in an SQL Command Affects <= 1.4.12 Patched in 1.4.13

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 35 languages, 5 at 90% or more

Plus 11 more locales with partial translations.

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2022-09-03 30K+ → 20K+ down after 746 days in tier
2. 2020-08-18 20K+ → 30K+ up after 651 days in tier
3. 2018-11-06 10K+ → 20K+ up after 584 days in tier
4. 2017-04-01 9K+ → 10K+ up after 31 days in tier
5. 2017-03-01 8K+ → 9K+ up after 22 days in tier
6. 2017-02-07 7K+ → 8K+ up after 34 days in tier
7. 2017-01-04 6K+ → 7K+ up after 33 days in tier
8. 2016-12-02 5K+ → 6K+ up after 24 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for wpForo Forum into a readme, a review or a deck. It updates itself.

wpForo Forum: 20K+ active installs, 4.7★ (390 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/wpforo