CVE-2019-15110

The wp-front-end-profile plugin before 0.2.2 for WordPress has XSS...

CVE-2024-13818

The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.8.3.9 through publicly exposed log files. This...

WordPress wp-front-end-profile plugin permissions permission and access control issues vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. wp-front-end-profile is a front-end configuration plugin used in it. The WordPress wp-front-end-profile plugin is vulnerable to...

WordPress wp-front-end-profile plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress wp-front-end-profile plugin. An attacker can...

CVE-2019-15110

The wp-front-end-profile plugin before 0.2.2 for WordPress has XSS...

CVE-2019-15111

The wp-front-end-profile plugin before 0.2.2 for WordPress has a privilege escalation issue...

CVE-2019-15111

CVE-2019-15111 affects the WordPress plugin wp-front-end-profile before 0.2.2. The root cause is a permissions/ACL flaw in the plugin that lets an attacker modify a user profile via POST data, overwriting wp_capabilities and wp_user_level to escalate privileges to administrator. Some reports also...

CVE-2019-15110

CVE-2019-15110 affects the WordPress plugin wp-front-end-profile prior to 0.2.2. The vulnerability is cross-site scripting (XSS). Public exploit details (WP Front End Profile

WP Front End Profile <= 0.2.1 - Privilege Escalation & Stored Cross-Site Scripting (XSS)

It is possible to modify a POST request to overwrite user meta including 'wpcapabilities' and 'wpuserlevel' which results in a privilege escalation vulnerability. User input is not sanitised or escaped on output resulting in a stored XSS vulnerability. Timeline: 2016-09-12: Vulnerability found...