Pressforward Vulnerabilities

The PressForward plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.9.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application which can be used t...

CVSS:

6.4

Affected:

up to 5.9.1

Fix:

No patched version reported

Disclosed:

Jul 31, 2025

CVE-2025-28987 on NVD →

The plugin PressForward for WordPress is vulnerable to Stored Cross-Site Scripting via the several parameter in versions up to, and including, 5.2.8 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user...

CVSS:

6.1

Affected:

up to 5.2.8

Fixed in:

5.2.9

Disclosed:

May 27, 2022

Core\Admin\PFTemplater.php in the PressForward plugin 5.2.3 and earlier for WordPress has XSS in the PATH_INFO to wp-admin/admin.php, related to PHP_SELF.

CVSS:

6.1

Affected:

up to 5.2.4

Fixed in:

5.2.4

Disclosed:

Aug 7, 2017

CVE-2017-12948 on NVD →