WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
user-management
Published
2025-01-14
Title
User Management <= 1.2 - Authenticated (Subscriber+) Privilege Escalation
Slug
user-menus
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
user-menus
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
user-messages
Published
2025-01-10
Title
User Messages <= 1.2.4 - Reflected XSS
Slug
user-meta
Published
2014-08-01
Title
User Meta Version 1.1.1 - Arbitrary File Upload
Slug
user-meta
Published
2022-05-09
Title
User Meta < 2.4.3 - Admin+ Stored Cross-Site Scripting
Slug
user-meta
Published
2022-05-16
Title
User Meta < 2.4.4 - Subscriber+ Local File Enumeration via Path Traversal
Slug
user-meta
Published
2024-04-25
Title
User Meta < 3.1 - Unauthenticated Sensitive Information Exposure
Slug
user-meta
Published
2024-11-08
Title
User Meta – User Profile Builder and User management plugin <= 3.1 - Insecure Direct Object Reference to Sensitive Information Exposure
Slug
user-meta
Published
2025-05-22
Title
User Meta <= 3.1.2 - Reflected Cross-Site Scripting
Slug
user-meta
Published
2025-09-10
Title
User Meta – User Profile Builder and User management plugin <= 3.1.2 - Authenticated (Subscriber+) Arbitrary File Deletion
Slug
user-meta-manager
Published
2016-02-04
Title
User Meta Manager <= 3.4.6 - Privilege Escalation
Slug
user-meta-manager
Published
2016-02-04
Title
User Meta Manager <= 3.4.6 - Authenticated Blind SQL Injection
Slug
user-meta-manager
Published
2016-02-08
Title
User Meta Manager <= 3.4.7 - Information Disclosure
Slug
user-meta-manager
Published
2023-01-19
Title
User Meta Manager <= 3.4.9 - Reflected XSS
Slug
user-meta-manager
Published
2023-01-10
Title
User Meta Manager <= 3.4.9 - CSRF
Slug
user-meta-shortcodes
Published
2021-11-15
Title
User Meta Shortcodes <= 0.5 - Contributor+ Unauthorized Arbitrary User Metadata Access
Slug
user-notes
Published
2025-09-26
Title
User Notes < 1.0.3 - Admin+ Stored XSS
Slug
user-password-reset
Published
2024-11-04
Title
User Password Reset <= 1.0 - Reflected Cross-Site Scripting
Slug
user-photo
Published
2011-02-17
Title
User Photo - Component Remote File Upload
Slug
user-photo
Published
2012-05-10
Title
User Photo < 0.9.5.2 - XSS
Slug
user-private-files
Published
2022-07-12
Title
User Private Files < 1.1.3 - Subscriber+ Arbitrary File Upload
Slug
user-private-files
Published
2023-09-04
Title
WordPress File Sharing < 2.0.4 - Admin+ Stored XSS
Slug
user-private-files
Published
2023-10-09
Title
WordPress File Sharing Plugin < 2.0.5 - Subscriber+ Sensitive Data and Files Exposure via IDOR
Slug
user-private-files
Published
2024-08-21
Title
User Private Files < 2.1.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private File Access