CVE-2024-40514: Incorrect Default Permissions

Insecure Permissions vulnerability in themesebrand Chatvia v.5.3.2 allows a remote attacker to escalate privileges via the User profile name and image upload functions...

WordPress WP User Profile Avatar plugin <= 1.0.5 - Cross-Site Request Forgery to Settings Update vulnerability

Cross-Site Request Forgery to Settings Update vulnerability discovered by yudha in WordPress Plugin WP User Profile Avatar versions = 1.0.5...

CVE-2025-22142

CVE-2025-22142 concerns NamelessMC. The vulnerability allows cross-site scripting via an admin-enabled extra field where a user may inject JavaScript that executes when a staff member views the user’s profile on the staff panel. Affected version details are not all consistently stated across sour...

PT-2025-4378

Name of the Vulnerable Software and Affected Versions NamelessMC versions prior to 2.1.3 Description The issue allows an admin to add an extra field that users can fill out, but users can inject javascript code into this field. This code is activated when a staffer visits the user's profile on th...

CVE-2024-13310

creationtimestamp| type| source ---|---|--- 2025-01-09 20:34:14+00:00| seen| https://infosec.exchange/users/cve/statuses/113800305263655085 2025-01-09 21:16:39+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lfdlzagvme2x 2025-01-09 21:17:29+00:00| seen|...

WordPress User Profile Builder plugin <= 3.12.9 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Brian Mungah in WordPress Plugin Profile Builder versions = 3.12.9...

CVE-2024-12738

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several user meta parameters in all versions up to, and including, 3.12.9 due to insufficient input sanitization and output escaping...

CVE-2024-12738 User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.9 - Unauthenticated Stored Cross-Site Scripting

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several user meta parameters in all versions up to, and including, 3.12.9 due to insufficient input sanitization and output escaping...

CVE-2024-12738

CVE-2024-12738 (User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor) is a WordPress plugin vulnerability: stored XSS via several user meta parameters, affecting all versions up to 3.12.9. The issue is unauthenticated and can execute scripts when users view i...

CVE-2024-12738 User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.9 - Unauthenticated Stored Cross-Site Scripting

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several user meta parameters in all versions up to, and including, 3.12.9 due to insufficient input sanitization and output escaping...

WordPress plugin User Profile Builder 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-1942 · WordPress · User Profile Builder

Name of the Vulnerable Software and Affected Versions: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress versions up to and including 3.12.9 Description: The issue is related to stored cross-site scripting, which occurs due to...

PT-2025-1831

Name of the Vulnerable Software and Affected Versions The Themes Coder – Create Android & iOS Apps For Your Woocommerce Site plugin for WordPress versions up to, and including, 1.3.4 Description The issue is related to privilege escalation via account takeover due to the plugin not properly...

CVE-2024-12738: Improper Neutralization of Input During Web Page Generation

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several user meta parameters in all versions up to, and including, 3.12.9 due to insufficient input sanitization and output escaping...

3D Avatar User Profile <= 1.0.0 - Reflected Cross-Site Scripting

Description The 3D Avatar User Profile plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2024-54358

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Enrico Cantori 3D Avatar User Profile 3d-avatar-user-profile allows Reflected XSS.This issue affects 3D Avatar User Profile: from n/a through = 1.0.0...

CVE-2024-54358 WordPress 3D Avatar User Profile plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Enrico Cantori 3D Avatar User Profile 3d-avatar-user-profile allows Reflected XSS.This issue affects 3D Avatar User Profile: from n/a through = 1.0.0...

CVE-2024-54358

CVE-2024-54358 is a Reflected XSS in the WordPress plugin for 3D Avatar User Profile (avatar 3D Creator/3D Avatar User Profile). The description states the issue as an Improper Neutralization of Input During Web Page Generation and affects 3D Avatar User Profile: from n/a through 1.0.0. The conne...

CVE-2024-54358: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Enrico Cantori 3D Avatar User Profile 3d-avatar-user-profile allows Reflected XSS.This issue affects 3D Avatar User Profile: from n/a through = 1.0.0...

PT-2024-12259 · Unknown · Display Custom Fields In The Frontend – Post/User Profile Fields

Name of the Vulnerable Software and Affected Versions: Display custom fields in the frontend – Post and User Profile Fields versions 1.2.0 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security...