WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
user-meta-manager
Published
2023-01-19
Title
User Meta Manager <= 3.4.9 - Reflected XSS
Slug
user-meta-manager
Published
2023-01-10
Title
User Meta Manager <= 3.4.9 - CSRF
Slug
user-meta-shortcodes
Published
2021-11-15
Title
User Meta Shortcodes <= 0.5 - Contributor+ Unauthorized Arbitrary User Metadata Access
Slug
user-notes
Published
2025-09-26
Title
User Notes < 1.0.3 - Admin+ Stored XSS
Slug
user-password-reset
Published
2024-11-04
Title
User Password Reset <= 1.0 - Reflected Cross-Site Scripting
Slug
user-photo
Published
2011-02-17
Title
User Photo - Component Remote File Upload
Slug
user-photo
Published
2012-05-10
Title
User Photo < 0.9.5.2 - XSS
Slug
user-private-files
Published
2022-07-12
Title
User Private Files < 1.1.3 - Subscriber+ Arbitrary File Upload
Slug
user-private-files
Published
2023-09-04
Title
WordPress File Sharing < 2.0.4 - Admin+ Stored XSS
Slug
user-private-files
Published
2023-10-09
Title
WordPress File Sharing Plugin < 2.0.5 - Subscriber+ Sensitive Data and Files Exposure via IDOR
Slug
user-private-files
Published
2024-08-21
Title
User Private Files < 2.1.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private File Access
Slug
user-private-files
Published
2025-02-18
Title
User Private Files – File Upload & Download Manager with Secure File Sharing < 2.1.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Slug
user-profile
Published
2024-03-15
Title
User profile < 2.0.21 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Slug
user-profile-meta
Published
2025-05-19
Title
User Profile Meta Manager <= 1.02 - Cross-Site Request Forgery to Privilege Escalation
Slug
user-referral-free
Published
2024-12-17
Title
User Referral <= 8.0 - Reflected Cross-Site Scripting
Slug
user-registration
Published
2019-01-09
Title
User Registration <= 1.5.5 - Authenticated Cross-Site Scripting (XSS)
Slug
user-registration
Published
2021-09-06
Title
User Registration < 2.0.2 - Low Privilege Stored Cross-Site Scripting
Slug
user-registration
Published
2022-11-21
Title
User Registration < 2.2.4.1 - Subscriber+ Arbitrary File Upload
Slug
user-registration
Published
2023-03-21
Title
User Registration < 2.3.3 - Subscriber+ PHP Object Injection
Slug
user-registration
Published
2023-01-20
Title
User Registration < 2.3.1 - Admin+ Stored XSS
Slug
user-registration
Published
2023-07-12
Title
User Registration < 3.0.2.1 - Subscriber+ Arbitrary File Upload
Slug
user-registration
Published
2023-06-29
Title
User Registration < 3.0.2 - Subscriber+ PHP Object Injection
Slug
user-registration
Published
2023-07-14
Title
User Registration < 3.0.2.1 - Subscriber+ Arbitrary File Upload Leading to RCE
Slug
user-registration
Published
2023-10-16
Title
User Registration < 3.0.4.2 - Admin+ Stored XSS
Slug
user-registration
Published
2024-03-06
Title
User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin < 3.1.5 - Unauthenticated Stored Self-Based Cross-Site Scripting