CVE-2026-18501: Improper Neutralization of Input During Web Page Generation

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and including, 1.2.69 due to insufficient input sanitization and...

CVE-2026-12102: Authorization Bypass Through User-Controlled Key

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the 'userid' parameter due to missing validation on a user controlled key...

CVE-2026-4979: Server-Side Request Forgery (SSRF)

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to blind Server-Side Request Forgery in all versions up to, and including, 1.2.58. This is due to insufficient URL origin validation in the processimagecrop...

CVE-2026-4977: Missing Authorization

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to Improper Access Control in all versions up to, and including, 1.2.58 This is due to insufficient field-level permission validation in the uploadfileremove AJAX handler whe...

CVE-2025-10003: Improper Neutralization of Special Elements used in an SQL Command

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uploadfileremove’ function and 'htmlvar' parameter in all versions up to, and including, 1.2.44 due to insufficient...

CVE-2025-9344: Improper Neutralization of Input During Web Page Generation

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'uwpprofile' and 'uwpprofileheader' shortcodes in all versions up to, and including, 1.2.42 due to insufficient...

CVE-2024-2423: Improper Neutralization of Input During Web Page Generation

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output...

Jtag Members Directory Arbitrary File Download Vulnerability

Joomla! is the U.S. Open Source Matters team developed a set of open source content management system CMS, the system provides RSS feeds, site search and other features . Jtag Members Directory is used in one of the member management plug-ins. An arbitrary file download vulnerability exists in...

CVE-2018-6008

Arbitrary File Download exists in the Jtag Members Directory 5.3.7 component for Joomla! via the downloadfile parameter...

CVE-2018-6008

Arbitrary File Download exists in the Jtag Members Directory 5.3.7 component for Joomla! via the downloadfile parameter...

Design/Logic Flaw

Arbitrary File Download exists in the Jtag Members Directory 5.3.7 component for Joomla! via the downloadfile parameter...

CVE-2018-6008

Arbitrary File Download exists in the Jtag Members Directory 5.3.7 component for Joomla! via the downloadfile parameter...

CVE-2018-6008

Affected software : Joomla! Jtag Members Directory 5.3.7. Vulnerability : Local File Inclusion via the download_file parameter, enabling arbitrary file download. Root cause : improper handling of input in the component leading to LFI. Impact : potential unauthorized access to sensitive server fil...

CVE-2018-6008: Exposure of Sensitive Information to an Unauthorized Actor

Arbitrary File Download exists in the Jtag Members Directory 5.3.7 component for Joomla! via the downloadfile parameter...

Joomla! Component Jtag Members Directory 5.3.7 - Arbitrary File Download

Joomla! Component Jtag Members Directory 5.3.7 - Arbitrary File Download Exploit Title: Joomla! Component Jtag Members Directory 5.3.7 - Arbitrary File Download Dork: N/A Date: 27.01.2018 Vendor Homepage: https://joomlatag.com/ Software Link:...

Joomla Jtag Members Directory 5.3.7 Component - Arbitrary File Download Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla! Component Jtag Members Directory 5.3.7 - Arbitrary File Download Dork: N/A Date: 27.01.2018 Vendor Homepage: https://joomlatag.com/ Software Link:...

Joomla! Jtag Members Directory 5.3.7 Arbitrary File Download

Exploit Title: Joomla! Component Jtag Members Directory 5.3.7 - Arbitrary File Download Dork: N/A Date: 27.01.2018 Vendor Homepage: https://joomlatag.com/ Software Link: https://extensions.joomla.org/extensions/extension/clients-a-communities/members-lists/jtag-members-directory/ Version: 5.3.7...

Joomla! Component Jtag Members Directory 5.3.7 - Arbitrary File Download

Exploit Title: Joomla! Component Jtag Members Directory 5.3.7 - Arbitrary File Download Dork: N/A Date: 27.01.2018 Vendor Homepage: https://joomlatag.com/ Software Link: https://extensions.joomla.org/extensions/extension/clients-a-communities/members-lists/jtag-members-directory/ Version: 5.3.7...

Joomla Jtag Members Directory 5.3.7 SQL Injection

Title: Joomla Jtag Members Directory 5.3.7 - SQL injection Credit: Bilal KARDADOU Vendor: https://joomlatag.com URL: https://extensions.joomla.org/extensions/extension/clients-a-communities/members-lists/jtag-members-directory/ Product: 'Joomla Jtag Members Directory 5.3.7' Developer: JoomlaTag...

Joomla Jtag Members Directory 5.3.7 SQL Injection Vulnerability

Exploit for php platform in category web applications Title: Joomla Jtag Members Directory 5.3.7 - SQL injection Credit: Bilal KARDADOU Vendor: https://joomlatag.com URL: https://extensions.joomla.org/extensions/extension/clients-a-communities/members-lists/jtag-members-directory/ Product: 'Jooml...