WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
userpro-mediamanager
Published
2025-01-30
Title
Media Manager for UserPro <= 3.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
Slug
userpro-mediamanager
Published
2025-01-30
Title
Media Manager for UserPro <= 3.12.0 - Missing Authorization to Unauthenticated Arbitrary Options Update
Slug
userpro-messaging
Published
2025-01-03
Title
Private Messages for UserPro <= 4.10.0 - Unauthenticated Local File Inclusion
Slug
userpro-messaging
Published
2025-01-03
Title
Private Messages for UserPro <= 4.10.0 - Reflected Cross-Site Scripting
Slug
users-control
Published
2024-09-24
Title
Users Control <= 1.0.16 - Unauthenticated Local File Inclusion
Slug
users-customers-import-export-for-wp-woocommerce
Published
2019-08-22
Title
Import Export WordPress Users < 1.3.2 - CSV Injection
Slug
users-customers-import-export-for-wp-woocommerce
Published
2020-03-11
Title
Import Export WordPress Users < 1.3.9 - Authenticated Arbitrary User Creation
Slug
users-customers-import-export-for-wp-woocommerce
Published
2023-07-14
Title
Export and Import Users and Customers < 2.4.2 - Shop Manager+ Privilege Escalation
Slug
users-customers-import-export-for-wp-woocommerce
Published
2023-12-12
Title
Export and Import Users and Customers < 2.4.9 - Shop Manager+ Arbitrary File Upload
Slug
users-customers-import-export-for-wp-woocommerce
Published
2024-03-28
Title
Import Export WordPress Users < 2.5.3 - Authenticated (Shop Manager+) Path Traversal
Slug
users-customers-import-export-for-wp-woocommerce
Published
2024-04-22
Title
Export and Import Users and Customers < 2.5.4 - Authenticated (Admin+) PHP Object Injection
Slug
users-customers-import-export-for-wp-woocommerce
Published
2025-03-21
Title
Export and Import Users and Customers < 2.6.3 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function
Slug
users-customers-import-export-for-wp-woocommerce
Published
2025-03-21
Title
Export and Import Users and Customers < 2.6.3 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function
Slug
users-customers-import-export-for-wp-woocommerce
Published
2025-03-21
Title
Export and Import Users and Customers < 2.6.3 - Authenticated (Admin+) PHP Object Injection via form_data Parameter
Slug
users-customers-import-export-for-wp-woocommerce
Published
2025-03-21
Title
Export and Import Users and Customers < 2.6.3 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function
Slug
users-to-csv
Published
2015-06-15
Title
Users to CSV <= 1.4.5 - Cross-Site Request Forgery (CSRF)
Slug
users-ultra
Published
2014-10-07
Title
Users Ultra 1.3.37 - SQL Injection
Slug
users-ultra
Published
2015-02-09
Title
Users Ultra <= 1.4.35 - SQL Injection
Slug
users-ultra
Published
2015-06-04
Title
Users Ultra <= 1.5.15 - SQL Injection
Slug
users-ultra
Published
2015-11-17
Title
Users Ultra Membership Plugin <= 1.5.58 - Unrestricted File Upload
Slug
users-ultra
Published
2015-12-02
Title
Users Ultra Membership Plugin <= 1.5.63 - Authenticated Blind SQL Injection
Slug
users-ultra
Published
2015-12-02
Title
Users Ultra Membership Plugin <= 1.5.62 - Authenticated Stored Cross-Site Scripting (XSS) & CSRF
Slug
users-ultra
Published
2022-03-29
Title
Users Ultra <= 3.1.0 - Unauthenticated SQL Injection
Slug
usersnap
Published
2023-02-02
Title
Usersnap < 4.17 - Admin+ Stored XSS
Slug
userspn
Published
2026-04-07
Title
Users manager – PN < 1.1.20 - Unauthenticated Privilege Escalation via Account Takeover via 'userspn_form_save' AJAX Action