WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
user-role-editor
Published
2016-04-05
Title
User Role Editor <= 4.24 - Privilege Escalation
Slug
user-role-editor
Published
2024-12-16
Title
User Role Editor < 4.64.4 - Cross-Site Request Forgery to Privilege Escalation
Slug
user-roles
Published
2025-02-02
Title
User Role <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
user-roles-and-capabilities
Published
2025-06-19
Title
User Roles and Capabilities <= 1.2.6 - Missing Authorization
Slug
user-session-synchronizer
Published
2025-04-09
Title
User Session Synchronizer <= 1.4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
user-shortcodes-plus
Published
2024-02-26
Title
User Shortcodes Plus <= 2.0.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via user_meta Shortcode
Slug
user-spam-remover
Published
2024-04-05
Title
User Spam Remover < 1.1 - Unauthenticated Sensitive Information Exposure
Slug
user-spam-remover
Published
2025-12-04
Title
User Spam Remover <= 1.1 - Unauthenticated Information Exposure
Slug
user-specific-content
Published
2025-12-31
Title
User Specific Content <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
user-submitted-posts
Published
2016-02-25
Title
User Submitted Posts < 20160215 - Stored Cross-Site Scripting (XSS)
Slug
user-submitted-posts
Published
2019-05-02
Title
User Submitted Posts < 20190501 - Arbitrary File Upload
Slug
user-submitted-posts
Published
2023-08-14
Title
User Submitted Posts < 20230811 - Unauthenticated Stored XSS
Slug
user-submitted-posts
Published
2023-09-05
Title
User Submitted Posts < 20230901 - Contributor+ Stored XSS via Shortcode
Slug
user-submitted-posts
Published
2023-09-06
Title
User Submitted Posts < 20230902 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
user-submitted-posts
Published
2023-10-10
Title
User Submitted Posts < 20230914 - Unauthenticated Arbitrary File Upload
Slug
user-submitted-posts
Published
2024-06-22
Title
User Submitted Posts < 20240516 - Admin+ Stored XSS
Slug
user-submitted-posts
Published
2025-04-02
Title
User Submitted Posts < 20250327 - Authenticated (Admin+) Stored Cross-Site Scripting
Slug
user-submitted-posts
Published
2026-01-01
Title
User Submitted Posts < 20251210 - Unauthenticated Open Redirect
Slug
user-submitted-posts
Published
2026-01-15
Title
User Submitted Posts < 20260113 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'usp_access' Shortcode
Slug
user-submitted-posts
Published
2026-01-23
Title
User Submitted Posts – Enable Users to Submit Posts from the Front End < 20260110 - Unauthenticated Stored Cross-Site Scripting via Custom Field
Slug
user-submitted-posts
Published
2026-02-17
Title
User Submitted Posts < 20260217 - Incorrect Authorization to Unauthenticated Category Restriction Bypass via 'user-submitted-category' Parameter
Slug
user-sync
Published
2025-09-16
Title
User Sync – Remote User Sync < 1.0.3 - Cross-Site Request Forgery to Plugin Deactivation
Slug
user-toolkit
Published
2024-10-25
Title
User Toolkit < 1.2.4 - Authenticated (Subscriber+) Authentication Bypass
Slug
user-verification
Published
2022-12-28
Title
User Verification < 1.0.94 - Authentication Bypass
Slug
user-verification
Published
2025-12-04
Title
Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification < 2.0.45 - Authentication Bypass to Account Takeover