wpForo Forum

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 49% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Modeled within the band wp.org reports; tightens as we track daily.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A declining trend compresses what a buyer would pay.

1. ★★★★★ Ricsca2

   5mo ago

   The best forum for WordPress

   Read on wp.org ↗
2. ★★★★★ kuyawing

   6mo ago

   I’ve been using this forum plugin for 2 years now. It is simply the best forum software out there. The support forum is also amazing.There’s no other WordPress forum out there that is better than wpforo.

   Read on wp.org ↗
3. ★★★★★ abigaildcd

   7mo ago

   I really like this plugin. The learning curve is bearable and the support on their forum is excellent. The provided layout are great and if you must customizing them is not that hard. Read the documentation it actually will help you and if like me you get stuck on something because you don’t understand go to the user forum. My issue was so simple to solve I slapped my forehead to remind myself that sometimes even my own stupidity has no limits. The plugin is excellent. Thank you to the developers to really thinking this through.

   Read on wp.org ↗
4. ★★★★★ bbrian017

   7mo ago

   wpForo has exceeded my expectations as a WordPress forum plugin. The feature set is robust, well thought out, and powerful without being overwhelming. Most importantly, it worked seamlessly with my existing WordPress setup and integrated perfectly with my Divi theme right out of the box—no hacks or workarounds required. The plugin also tied cleanly into my pre-existing WordPress database, which made deployment smooth and worry-free. Performance has been solid, and the forum structure is flexible enough to support both simple discussions and more advanced community use cases. What really sets wpForo apart, though, is the support. I ran into two CSS issues that were beyond my skill level—I’m not a coder—and the support I received through the forums was excellent. The responses were friendly, accurate, and genuinely helpful, and the turnaround time was impressively fast. It’s rare to find a plugin that combines strong features, smooth theme compatibility, and responsive, high-quality support. wpForo delivers on all three. Highly recommended.

   Read on wp.org ↗
5. ★★★★★ Martin Sauter

   9mo ago

   wpForo is a feature-rich, highly configurable forum solution for free. Highly recommended!

   Read on wp.org ↗
6. ★★★★★ fufy

   1.1y ago

   This free plugin totally gives a lot. It provides everything needed to build a forum, one plugin and that’s all. Best plugin ever. This topic was modified 12 months ago by fufy.

   Read on wp.org ↗
7. ★★★★★ geddi2

   1.1y ago

   Any idea how to switch to German? Unfortunately, all my efforts have failed. I’ve placed the files wpforo-de_DE.po and wpforo-de_DE.mo in /languages/plugins/ – with no success. Switching to “Deutsch-Sie” or “Deutsch” didn’t help either. The author documentation page for translating WPForo shows “In progress” with a date of 2022.This all seems a bit too casual for a serious forum installation. So I guess I’ll have to look for something else. ———————– Irgendeine Idee, wie man auf Deutsch umstellt? Leider scheitern alle meine Bemühungen. Ich habe die Dateien wpforo-de_DE.po und wpforo-de_DE.mo in /languages/plugins/ abgelegt – ohne Erfolg. Auch das Umstellen auf “Deutsch-Sie” oder “Deutsch” halfen nicht. Die Autorendokumentationsseite zur Übersetzung von WPForo zeigt „In Bearbeitung“ mit einem Datum aus dem Jahr 2022 an.Das alles scheint mir etwas zu lässig für eine seriöse Foruminstallation. Also muss ich mich wohl nach etwas anderem umsehen.

   Read on wp.org ↗
8. ★★★★★ mikesafh

   1.2y ago

   I’m running this plugin on one, soon to be maybe two, non-profit websites, and needed a reasonable option to not have to keep using Facebook when people (especially those that like me don’t like Facebook) on the website wanted forum functionality. This fits the bill, and support for it has been outstanding when needed. There are so many features I haven’t even looked at too, but haven’t had to. Yet.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 3.1.2 Security: Fixed Stored XSS vulnerability in profile fields Security: Fixed IDOR vulnerability in AI Chat messaging Security: Fixed Mass Assignment vulnerability with privilege escalation via profile fields Added: Ultimat 3.1.2
2. — Version 3.1.1 Security: Fixed Broken Authentication vulnerability allowing administrator email mutation Security: Fixed PHP Object Injection vulnerability via widget AJAX handlers 3.1.1
3. — Version 3.1.0 Security: Fixed vulnerability issue in the Revisions module Security: Fixed vulnerability issue in Gutenberg block renderers New: Tools – Email Queue Tab, email notifications now sent asynchronously with automatic fallba 3.1.0
4. — Version 3.0.9 Fixed: AI Task “Topic Tag Manager” now runs asynchronously to avoid blocking topic creation Fixed: AI Content Moderation now correctly exempts admins and moderators from spam detection Fixed: AI Logs timezone display – t 3.0.9
5. — Version 3.0.8 Fixed: AI Chat WordPress content citations not displaying as clickable links Updated: New phrases to wpForo Phrase System Updated: Translation template (wpforo.pot) with AI feature phrases 3.0.8
6. — Version 3.0.7 Security: Fixed usergroup privilege escalation vulnerability during registration New: WordPress Indexing now has its own dedicated admin tab Fixed: AI Chatbot now respects “Bot Reply Unapproved” setting correctly Fixed: 3.0.7

48 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 4.3 wpForo Forum <= 3.1.2 - Missing Authorization to Authenticated (Subscriber+) Account Status Manipulation ↗
   2026-07-27 CVE-2026-12698 Missing Authorization Affects <= 3.1.2 Patched in 3.1.3
2. Medium · 6.4 wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
   2026-07-20 CVE-2026-12696 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.1.1 Patched in 3.1.2
3. Medium · 4.3 wpForo Forum <= 3.1.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Chat Message Deletion ↗
   2026-07-16 CVE-2026-12697 Authorization Bypass Through User-Controlled Key Affects <= 3.1.1 Patched in 3.1.2
4. Medium · 6.4 wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field ↗
   2026-07-15 CVE-2026-15021 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.1.1 Patched in 3.1.2
5. Medium · 6.5 wpForo Forum <= 3.0.9 - Authenticated (Contributor+) SQL Injection ↗
   2026-06-26 CVE-2026-57636 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 3.0.9 Patched in 3.1.0
6. Medium · 5.3 wpForo Forum <= 3.1.0 - Missing Authorization ↗
   2026-06-04 CVE-2026-49767 Missing Authorization Affects <= 3.1.0 Patched in 3.1.1
7. High · 8.1 wpForo Forum <= 3.1.0 - Unauthenticated PHP Object Injection ↗
   2026-06-04 CVE-2026-49769 Deserialization of Untrusted Data Affects <= 3.1.0 Patched in 3.1.1
8. Medium · 5.3 wpForo Forum <= 3.0.6 - Missing Authorization ↗
   2026-05-18 CVE-2026-42682 Missing Authorization Affects <= 3.0.6 Patched in 3.0.7
9. High · 7.5 wpForo Forum <= 3.0.4 - Unauthenticated SQL Injection ↗
   2026-05-07 CVE-2026-40798 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 3.0.4 Patched in 3.0.5
10. Medium · 5.3 wpForo Forum < 3.0.2 - Missing Authorization ↗
    2026-04-21 CVE-2026-40767 Missing Authorization Affects < 3.0.2 Patched in 3.0.2
11. High · 8.1 wpForo Forum <= 3.0.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Custom Profile Field File Path ↗
    2026-04-20 CVE-2026-6248 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 3.0.5 Patched in 3.0.6
12. Medium · 6.5 wpForo Forum <= 2.4.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter ↗
    2026-04-16 CVE-2026-4666 Missing Authorization Affects <= 2.4.16 Patched in 3.0.0
13. High · 7.1 wpForo Forum <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter ↗
    2026-04-10 CVE-2026-5809 External Control of File Name or Path Affects <= 3.0.2 Patched in 3.0.3
14. High · 8.8 wpForo Forum <= 2.4.16 - Authenticated (Subscriber+) Arbitrary File Deletion via Post Body ↗
    2026-04-03 CVE-2026-3666 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 2.4.16 Patched in 2.4.17
15. High · 7.5 wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection ↗
    2026-02-18 CVE-2026-1581 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 2.4.14 Patched in 2.4.15
16. High · 8.8 wpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection ↗
    2026-02-10 CVE-2026-0910 Deserialization of Untrusted Data Affects <= 2.4.13 Patched in 2.4.14
17. High · 7.5 wpForo Forum <= 2.4.12 - Unauthenticated SQL Injection ↗
    2025-12-13 CVE-2025-13126 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 2.4.12 Patched in 2.4.13
18. Medium · 5.3 wpForo Forum <= 2.4.10 - Missing Authorization ↗
    2025-11-18 CVE-2025-66070 Missing Authorization Affects <= 2.4.10 Patched in 2.4.11
19. Medium · 6.5 wpForo Forum <= 2.4.9 - Authenticated (Susbscriber+) SQL Injection ↗
    2025-10-31 CVE-2025-11740 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 2.4.9 Patched in 2.4.10
20. High · 7.5 wpForo Forum <= 2.4.8 - Unauthenticated SQL Injection via get_members Function ↗
    2025-10-24 CVE-2025-4203 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 2.4.8 Patched in 2.4.9
21. Medium · 4.3 wpForo Forum <= 2.4.6 - Authenticated (Subscriber+) Insecure Direct Object Reference ↗
    2025-09-03 CVE-2025-58597 Authorization Bypass Through User-Controlled Key Affects <= 2.4.6 Patched in 2.4.7
22. Medium · 5.4 wpForo Forum <= 2.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar ↗
    2025-07-09 CVE-2025-4406 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.4.5 Patched in 2.4.6
23. High · 8.8 wpForo Forum <= 2.4.3 - Authenticated (Subscriber+) Privilege Escalation ↗
    2025-04-02 CVE-2025-31420 Incorrect Privilege Assignment Affects <= 2.4.3 Patched in 2.4.4
24. Medium · 6.5 wpForo Forum <= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in update ↗
    2025-02-27 CVE-2025-0764 Improper Input Validation Affects <= 2.4.1 Patched in 2.4.2
25. Medium · 5.3 wpForo Forum <= 2.3.4 - Unauthenticated Sensitive Information Exposure ↗
    2024-08-16 CVE-2024-43289 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 2.3.4 Patched in 2.3.5
26. Medium · 4.3 wpForo Forum <= 2.3.4 - Authenticated (Subscriber+) Insecure Direct Object Reference ↗
    2024-08-16 CVE-2024-43288 Authorization Bypass Through User-Controlled Key Affects <= 2.3.4 Patched in 2.3.5
27. Critical · 9.9 wpForo Forum <= 2.3.3 - Authenticated (Contributor+) SQL Injection ↗
    2024-05-31 CVE-2024-3200 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 2.3.3 Patched in 2.3.4
28. Critical · 9.8 wpForo Forum <= 2.2.3 - Unauthenticated Privilege Escalation ↗
    2023-11-20 CVE-2023-47868 Incorrect Privilege Assignment Affects <= 2.2.3 Patched in 2.2.4
29. Medium · 4.3 wpForo Forum <= 2.2.8 - Cross-Site Request Forgery via logout() ↗
    2023-11-20 CVE-2023-47870 Cross-Site Request Forgery (CSRF) Affects <= 2.2.8 Patched in 2.2.9
30. Medium · 6.4 wpForo Forum <= 2.2.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
    2023-11-20 CVE-2023-47872 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.2.3 Patched in 2.2.4
31. Medium · 4.3 wpForo Forum <= 2.2.5 - Missing Authorization ↗
    2023-11-20 CVE-2023-47869 Missing Authorization Affects <= 2.2.5 Patched in 2.2.6
32. Medium · 6.1 wpForo Forum <= 2.1.8 - Reflected Cross-Site Scripting via 'wpforo_debug' ↗
    2023-07-03 CVE-2023-2309 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.1.8 Patched in 2.1.9
33. High · 8.8 wpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents ↗
    2023-06-01 CVE-2023-2249 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Affects <= 2.1.7 Patched in 2.1.8
34. Medium · 5.4 wpForo Forum <= 2.0.9 - Authenticated (Subscriber+) HTML Injection ↗
    2022-12-07 CVE-2022-38055 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Affects <= 2.0.9 Patched in 2.1.0
35. Medium · 6.3 wpForo Forum <= 2.0.5 - Insecure Direct Object Reference to Forum Privacy Change ↗
    2022-11-26 CVE-2022-40206 Authorization Bypass Through User-Controlled Key Affects <= 2.0.5 Patched in 2.0.6
36. High · 8.8 wpForo Forum <= 2.0.9 - Authenticated (Subscriber+) Arbitrary File Upload ↗
    2022-11-09 CVE-2022-40200 Unrestricted Upload of File with Dangerous Type Affects <= 2.0.9 Patched in 2.1.0
37. High · 8.8 wpForo Forum <= 2.0.9 - Cross-Site Request Forgery ↗
    2022-11-09 CVE-2022-40192 Cross-Site Request Forgery (CSRF) Affects <= 2.0.9 Patched in 2.1.0
38. Medium · 5.4 wpForo Forum <= 2.0.5 - Insecure Direct Object Reference to Forum Status Change ↗
    2022-09-26 CVE-2022-40205 Authorization Bypass Through User-Controlled Key Affects <= 2.0.5 Patched in 2.0.6
39. High · 8.8 wpForo Forum <= 2.0.5 - Cross-Site Request Forgery ↗
    2022-09-08 CVE-2022-38144 Cross-Site Request Forgery (CSRF) Affects <= 2.0.5 Patched in 2.0.6
40. High · 8.8 wpForo Forum <= 2.0.5 - Cross-Site Request Forgery ↗
    2022-09-08 CVE-2022-40632 Cross-Site Request Forgery (CSRF) Affects <= 2.0.5 Patched in 2.0.6
41. Medium · 6.1 wpForo Forum <= 1.9.6 - Open Redirect ↗
    2021-06-14 CVE-2021-24406 URL Redirection to Untrusted Site ('Open Redirect') Affects <= 1.9.6 Patched in 1.9.7
42. Medium · 6.1 wpForo Forum <= 1.6.5 - Cross-Site Scripting via langid parameter ↗
    2020-05-04 CVE-2019-19111 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.6.5 Patched in 1.7.0
43. High · 8.8 wpForo Forum <= 1.6.5 - Cross-Site Request Forgery ↗
    2020-05-04 CVE-2019-19109 Cross-Site Request Forgery (CSRF) Affects <= 1.6.5 Patched in 1.7.0
44. Medium · 6.1 wpForo Forum <= 1.6.5 - Cross-Site Scripting via wpf-dw-td-value class ↗
    2020-05-04 CVE-2019-19112 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.6.5 Patched in 1.7.0
45. Medium · 4.8 wpForo Forum <= 1.6.5 - Cross-Site Scripting via s parameter ↗
    2020-05-04 CVE-2019-19110 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.6.5 Patched in 1.7.0
46. Critical · 9.8 wpForo < = 1.5.1 - Privilege Escalation ↗
    2018-09-06 CVE-2018-16613 Improper Privilege Management Affects <= 1.5.1 Patched in 1.5.2
47. Medium · 6.1 wpForo Forum < 1.4.12 - Reflected Cross-Site Scripting ↗
    2018-06-01 CVE-2018-11709 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.4.12 Patched in 1.4.12
48. Critical · 9.8 wpForo Forum <= 1.4.12 - SQL Injection ↗
    2018-05-27 CVE-2018-11515 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 1.4.12 Patched in 1.4.13

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 35 languages, 4 at 90% or more

Plus 11 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

No tier crossings observed yet.

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Asgaros Forum 10K+ installs · 4.7★ · 3 shared tags A
• Forumax – AI Powered Advanced Community Forum Plugin 600+ installs · 4.6★ · 3 shared tags A
• Ultimate Member – ForumWP forum integration 500+ installs · 2.9★ · 3 shared tags D
• bbPress Voting 500+ installs · 4.3★ · 3 shared tags A
• V Vanilla Forums 100+ installs · 3.3★ · 3 shared tags F
• B bbPress Integration 70+ installs · 3.6★ · 3 shared tags D

Embed this report card

Drop a live Pulse card for wpForo Forum into a readme, a review or a deck. It updates itself.

wpForo Forum: 20K+ active installs, 4.7★ (390 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/wpforo