CVE-2025-4315

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.23. This is due to the plugin allowing a user to update arbitrary user meta through the updateusermeta function. This makes it possible for...

CVE-2025-4315

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.23. This is due to the plugin allowing a user to update arbitrary user meta through the updateusermeta function. This makes it possible for...

CVE-2025-4315 CubeWP – All-in-One Dynamic Content Framework <= 1.1.23 - Authenticated (Subscriber+) Privilege Escalation

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.23. This is due to the plugin allowing a user to update arbitrary user meta through the updateusermeta function. This makes it possible for...

CVE-2025-4315

Summary: CVE-2025-4315 affects the CubeWP – All-in-One Dynamic Content Framework plugin for WordPress. The vulnerability is an authenticated privilege-escalation flaw exploitable by users with Subscriber+ privileges to elevate to Administrator via improper handling of update_user_meta(), affectin...

PT-2025-25201 · WordPress · Cubewp

Name of the Vulnerable Software and Affected Versions: The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress version 1.1.23 and earlier Description: The issue is related to Privilege Escalation, allowing authenticated attackers with Subscriber-level access and above to elevate...

CVE-2025-4672

The Offsprout Page Builder plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization placed on the permissioncallback function in versions 2.2.1 to 2.15.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to read, create,...

CVE-2025-4672

The Offsprout Page Builder plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization placed on the permissioncallback function in versions 2.2.1 to 2.15.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to read, create,...

CVE-2025-4672

CVE-2025-4672 concerns Offsprout Page Builder for WordPress, where versions 2.2.1–2.15.2 suffer from privilege escalation due to improper authorization in the permission_callback() function. The flaw enables authenticated users with Contributor-level access and above to read, create, update, or d...

CVE-2025-4672 Offsprout Page Builder 2.2.1 - 2.15.2 - Authenticated (Contributor+) Privilege Escalation via permission_callback Function

The Offsprout Page Builder plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization placed on the permissioncallback function in versions 2.2.1 to 2.15.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to read, create,...

CVE-2025-4672: Improper Authorization

The Offsprout Page Builder plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization placed on the permissioncallback function in versions 2.2.1 to 2.15.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to read, create,...

CVE-2025-47611

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Khaled User Meta user-meta allows Reflected XSS.This issue affects User Meta: from n/a through = 3.1.2...

CVE-2025-47611

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Khaled User Meta user-meta allows Reflected XSS.This issue affects User Meta: from n/a through = 3.1.2...

CVE-2025-47611 WordPress User Meta plugin <= 3.1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Khaled User Meta allows Reflected XSS. This issue affects User Meta: from n/a through 3.1.2...

CVE-2025-47611 WordPress User Meta plugin <= 3.1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Khaled User Meta user-meta allows Reflected XSS.This issue affects User Meta: from n/a through = 3.1.2...

CVE-2025-47611

CVE-2025-47611 reflects a Reflected Cross-Site Scripting (XSS) flaw in the WordPress plugin User Meta (versions n/a through 3.1.2). Root cause: improper input neutralization during web page generation. Impact (per metrics): confidentiality, integrity, and availability are Low to Low, with user in...

CVE-2024-10537

The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the validateusermetakey function in all versions up to, and including, 2.9.11. This makes it possible for authenticated attackers, with...

CVE-2024-9262

The User Meta – User Profile Builder and User management plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.1 via the getUser due to missing validation on a user controlled key. This makes it possible for authenticated attackers...

CVE-2024-33575

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in User Meta user-meta.This issue affects User Meta: from n/a through 3.0...

CVE-2023-0814

The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the usermeta shortcode in versions up to, and including 3.9.0. This is due to insufficient restriction on sensitive user meta values that can be called via that...

CVE-2023-6969

The User Shortcodes Plus plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.2 via the usermeta shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level...