Plugin icon

UserPro (5.1.11)

userpro

Vulnerabilities:

25

Last Updated:

September 4, 2025

Active Installs:

n/a

Published
Title
Fixed in
CVSS
Published
2025-12-25
Title
Userpro <= 5.1.9 - Missing Authorization
Fixed in
No known fix
CVSS
5.3 (medium)
Published
2025-06-13
Title
UserPro - Community and User Profile WordPress Plugin <= 5.1.10 - Unauthenticated Arbitrary File Read
Fixed in
No known fix
CVSS
5.9 (medium)
Published
2024-12-19
Title
Userpro <= 5.1.9 - Unauthenticated Local File Inclusion
Fixed in
No known fix
CVSS
9.8 (critical)
Published
2024-12-19
Title
Userpro <= 5.1.9 - Authenticated (Contributor+) SQL Injection
Fixed in
No known fix
CVSS
6.5 (medium)
Published
2024-12-19
Title
Userpro <= 5.1.9 - Reflected Cross-Site Scripting
Fixed in
No known fix
CVSS
6.1 (medium)
Published
2024-12-19
Title
Userpro <= 5.1.9 - Missing Authorization
Fixed in
No known fix
CVSS
4.3 (medium)
Published
2024-05-21
Title
UserPro < 5.1.9 - Unauthenticated Account Takeover to Privilege Escalation
Fixed in
Fixed in 5.1.9
CVSS
9.8 (critical)
Published
2024-02-01
Title
UserPro < 5.1.7 - Disabled Membership Registration Bypass
Fixed in
Fixed in 5.1.7
CVSS
5.3 (medium)
Published
2023-11-30
Title
UserPro < 5.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Fixed in
Fixed in 5.1.6
CVSS
6.4 (medium)
Published
2023-11-21
Title
UserPro < 5.1.2 - Authentication Bypass to Administrator
Fixed in
Fixed in 5.1.2
CVSS
9.8 (critical)
Published
2023-11-21
Title
UserPro < 5.1.5 - Authenticated (Subscriber+) Privilege Escalation
Fixed in
Fixed in 5.1.5
CVSS
8.8 (high)
Published
2023-11-21
Title
UserPro < 5.1.2 - Sensitive Information Disclosure via Shortcode
Fixed in
Fixed in 5.1.2
CVSS
6.5 (medium)
Published
2023-11-21
Title
UserPro < 5.1.1 - Cross-Site Request Forgery to PHP Object Injection
Fixed in
Fixed in 5.1.1
CVSS
8.8 (high)
Published
2023-11-21
Title
UserPro < 5.1.2 - Cross-Site Request Forgery to Privilege Escalation
Fixed in
Fixed in 5.1.2
CVSS
8.8 (high)
Published
2023-11-21
Title
UserPro < 5.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via userpro_save_userdata
Fixed in
Fixed in 5.1.1
CVSS
6.1 (medium)
Published
2023-11-21
Title
UserPro < 5.1.2 - Insecure Password Reset Mechanism
Fixed in
Fixed in 5.1.2
CVSS
9.8 (critical)
Published
2023-11-21
Title
UserPro < 5.1.2 - Cross-Site Request Forgery to Sensitive Information Exposure
Fixed in
Fixed in 5.1.2
CVSS
6.1 (medium)
Published
2023-11-21
Title
UserPro < 5.1.2 - Cross-Site Request Forgery via multiple functions
Fixed in
Fixed in 5.1.2
CVSS
6.3 (medium)
Published
2023-11-21
Title
UserPro < 5.1.2 - Missing Authorization via multiple functions
Fixed in
Fixed in 5.1.2
CVSS
7.3 (high)
Published
2023-11-21
Title
UserPro < 5.1.5 - Missing Authorization to Arbitrary Shortcode Execution via userpro_shortcode_template
Fixed in
Fixed in 5.1.5
CVSS
6.5 (medium)
Published
2019-08-25
Title
UserPro < 4.9.35.1 - Unauthenticated Reflected XSS
Fixed in
Fixed in 4.9.35.1
CVSS
6.1 (medium)
Published
2018-09-10
Title
UserPro <= 4.9.27 - User Registration With Administrator Role
Fixed in
Fixed in 4.9.28
CVSS
n/a
Published
2018-08-31
Title
UserPro <= 4.9.23 - Unauthenticated Cross-Site Scripting (XSS)
Fixed in
Fixed in 4.9.24
CVSS
6.1 (medium)
Published
2018-03-13
Title
UserPro <= 4.9.20 - User Registration With Administrator Role
Fixed in
Fixed in 4.9.21
CVSS
n/a
Published
2017-11-10
Title
UserPro <= 4.9.17 - Authentication Bypass
Fixed in
Fixed in 4.9.17.1
CVSS
9.8 (critical)