WP w3all phpBB vulnerabilities

The WP w3all phpBB plugin (axew3.com) in versions up to 3.1.0 contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation.

SQL Injection vulnerability in WP w3all phpBB plugin versions up to 3.0.5, exploitable by a user with Subscriber role. A low-privileged user can inject SQL queries into the database.

Unauthenticated XSS vulnerability in WP w3all phpBB versions up to 3.0.6. An attacker can inject malicious script that executes in the victim's browser.