WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
user-ip-and-location
Published
2023-04-28
Title
User IP and Location < 2.2.1 - Contributor+ Stored XSS
Slug
user-language-switch
Published
2025-08-07
Title
User Language Switch <= 1.6.10 - Reflected Cross-Site Scripting
Slug
user-language-switch
Published
2026-02-13
Title
User Language Switch <= 1.6.10 - Authenticated (Administrator+) Server-Side Request Forgery via 'info_language' Parameter
Slug
user-language-switch
Published
2026-02-13
Title
User Language Switch <= 1.6.10 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'tab_color_picker_language_switch' Parameter
Slug
user-list
Published
2025-02-21
Title
User List <= 1.5.1 - Reflected Cross-Site Scripting
Slug
user-location-and-ip
Published
2023-10-18
Title
User Location and IP < 2.0 - Contributor+ Stored XSS
Slug
user-login-history
Published
2017-10-26
Title
User Login History <= 1.5 - Cross-Site Scripting (XSS)
Slug
user-login-history
Published
2025-05-07
Title
User Login History < 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
user-login-log
Published
2017-03-01
Title
User Login Log - Stored Cross-Site Scripting (XSS)
Slug
user-magic
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
user-management
Published
2024-11-13
Title
User Management < 1.2 - Subscriber+ Arbitrary File Upload
Slug
user-management
Published
2025-01-14
Title
User Management <= 1.2 - Authenticated (Subscriber+) Privilege Escalation
Slug
user-menus
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
user-menus
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
user-messages
Published
2025-01-10
Title
User Messages <= 1.2.4 - Reflected XSS
Slug
user-meta
Published
2014-08-01
Title
User Meta Version 1.1.1 - Arbitrary File Upload
Slug
user-meta
Published
2022-05-09
Title
User Meta < 2.4.3 - Admin+ Stored Cross-Site Scripting
Slug
user-meta
Published
2022-05-16
Title
User Meta < 2.4.4 - Subscriber+ Local File Enumeration via Path Traversal
Slug
user-meta
Published
2024-04-25
Title
User Meta < 3.1 - Unauthenticated Sensitive Information Exposure
Slug
user-meta
Published
2024-11-08
Title
User Meta – User Profile Builder and User management plugin <= 3.1 - Insecure Direct Object Reference to Sensitive Information Exposure
Slug
user-meta
Published
2025-05-22
Title
User Meta <= 3.1.2 - Reflected Cross-Site Scripting
Slug
user-meta
Published
2025-09-10
Title
User Meta – User Profile Builder and User management plugin <= 3.1.2 - Authenticated (Subscriber+) Arbitrary File Deletion
Slug
user-meta-manager
Published
2016-02-04
Title
User Meta Manager <= 3.4.6 - Privilege Escalation
Slug
user-meta-manager
Published
2016-02-04
Title
User Meta Manager <= 3.4.6 - Authenticated Blind SQL Injection
Slug
user-meta-manager
Published
2016-02-08
Title
User Meta Manager <= 3.4.7 - Information Disclosure