CVE-2022-1051

CVE-2022-1051 WPQA 5.2 - Subscriber+ Stored Cross-Site Scripting via Profile fields Description The plugin, used as a companion plugin for the Discy and Himer themes, does not sanitise and escape the city, phone or profile credentials fields when outputting it in the profile page, allowing any...

CVE-2026-45144

Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, GET /user/username is anonymously reachable and renders six user-editable profile fields firstname, lastname, competences, openarea, teach, and diplomas inside % autoescape false %, without server-side sanitization ...

EUVD-2026-113996

Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, GET /user/username is anonymously reachable and renders six user-editable profile fields firstname, lastname, competences, openarea, teach, and diplomas inside % autoescape false %, without server-side sanitization ...

CVE-2026-45144: chamilo chamilo-lms: Chamilo LMS is an open-source learning management system

Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, GET /user/username is anonymously reachable and renders six user-editable profile fields firstname, lastname, competences, openarea, teach, and diplomas inside % autoescape false %, without server-side sanitization ...

PT-2026-133605

Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, GET /user/username is anonymously reachable and renders six user-editable profile fields firstname, lastname, competences, openarea, teach, and diplomas inside % autoescape false %, without server-side sanitization ...

CVE-2026-108685 WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields

The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator...

CVE-2026-108685

The WP Post Author WordPress plugin (versions before 4.2.0 ) is vulnerable to an unauthenticated modification of the first user account's profile fields. The root cause is a failure to verify account creation timestamps during front-end registration; if a registration form declares specific field...

WordPress WP Post Author plugin < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields vulnerability

Unauthenticated Modification of the First User Account's Profile Fields vulnerability discovered by Mutantgun in WordPress Plugin WP Post Author versions 4.2.0...

PT-2026-127898

The MemberPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.14.1. This is due to a bypassable nonce verification check in the save profile fields function that uses an isset condition at line 1119, allowing the security check to be complete...

Linux Distros Unpatched Vulnerability : CVE-2026-17025

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'Current location' and 'Author profile image URL' Profile Fields in all versio...

CVE-2026-17001

The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-17001

The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.4.5 . The root cause is insufficient input sanitization and output escaping within the Custom Column User Meta Profile Fields . This allows authe...

EUVD-2026-101840

The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-17001 Import and export users and customers <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields

The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-17001 Import and export users and customers <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields

The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-17001: Improper Neutralization of Input During Web Page Generation

The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

WordPress Import and Export Users and Customers 2.4.5 Cross Site Scripting

WordPress Import and Export Users and Customers plugin versions through 2.4.5 contain an authenticated stored cross site scripting vulnerability through custom column user meta profile fields...

PT-2026-114771

The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-109318 Grav Git Sync 1.0.2 through 3.4.12 Command Injection via Commit Author

Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions into profile fields. When the gravuser or gravfull author mode is enabled, attackers can set a malicious username, full...

CVE-2026-109318: Improper Neutralization of Special Elements used in an OS Command

Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions into profile fields. When the gravuser or gravfull author mode is enabled, attackers can set a malicious username, full...