PT-2026-21158

Name of the Vulnerable Software and Affected Versions vanquish User Extra Fields wp-user-extra-fields versions through 17.0 Description The software contains a flaw related to improper limitation of a pathname to a restricted directory, also known as Path Traversal. This allows unauthorized acces...

PT-2026-21157

Name of the Vulnerable Software and Affected Versions vanquish User Extra Fields versions prior to 17.1 Description The software contains a flaw related to improper limitation of a pathname to a restricted directory, also known as a 'Path Traversal' issue. This allows for potential unauthorized...

WordPress User Extra Fields plugin <= 16.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin User Extra Fields versions = 16.8...

WordPress User Extra Fields plugin <= 17.0 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Phat RiO in WordPress Plugin User Extra Fields versions = 17.0...

WordPress User Extra Fields plugin <= 17.0 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Phat RiO in WordPress Plugin User Extra Fields versions = 17.0...

CVE-2023-4469

The Profile Extra Fields by BestWebSoft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the prflxtrfldsexportfile function in versions up to, and including, 1.2.7. This makes it possible for unauthenticated attackers to expose potentially...

WordPress User Extra Fields plugin <= 16.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin User Extra Fields versions = 16.8...

CVE-2025-67579

Missing Authorization vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Extra Fields: from n/a through = 16.8...

EUVD-2025-201955

Missing Authorization vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Extra Fields: from n/a through = 16.8...

CVE-2025-67579

Missing Authorization vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Extra Fields: from n/a through = 16.8...

CVE-2025-67579

CVE-2025-67579 affects WordPress Plugin WordPress User Extra Fields (wp-user-extra-fields). The Wordfence vulnerability details show a Missing Authorization issue in this plugin version range (

CVE-2025-67579 WordPress User Extra Fields plugin <= 16.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Extra Fields: from n/a through = 16.8...

CVE-2025-67579 WordPress User Extra Fields plugin <= 16.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Extra Fields: from n/a through = 16.8...

WordPress plugin User Extra Fields 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-49953

Name of the Vulnerable Software and Affected Versions vanquish User Extra Fields versions prior to 16.9 Description An authorization issue exists in vanquish User Extra Fields wp-user-extra-fields, allowing exploitation due to incorrectly configured access control security levels. The issue relat...

CVE-2025-7846

The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the savefields function in all versions up to, and including, 16.7. This makes it possible for authenticated attackers, with Subscriber-level access and above,...

CVE-2025-7846 WordPress User Extra Fields <= 16.7 - Authenticated (Subscriber+) Arbitrary File Deletion via save_fields Function

The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the savefields function in all versions up to, and including, 16.7. This makes it possible for authenticated attackers, with Subscriber-level access and above,...

EUVD-2025-37305

The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the savefields function in all versions up to, and including, 16.7. This makes it possible for authenticated attackers, with Subscriber-level access and above,...

CVE-2025-7846 WordPress User Extra Fields <= 16.7 - Authenticated (Subscriber+) Arbitrary File Deletion via save_fields Function

The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the savefields function in all versions up to, and including, 16.7. This makes it possible for authenticated attackers, with Subscriber-level access and above,...

CVE-2025-7846

CVE-2025-7846 affects the WordPress plugin WordPress User Extra Fields (versions up to and including 16.7). The vulnerability is described as an arbitrary file deletion caused by insufficient validation in the save_fields() function. An attacker with Subscriber-level or higher can delete arbitrar...