Default credentials

The WP User Manager WordPress plugin before 2.6.3 does not ensure that the user ID to reset the password of is related to the reset key given. As a result, any authenticated user can reset the password to an arbitrary value of any user knowing only their ID, and gain access to their account...

CVE-2021-24655

The WP User Manager WordPress plugin (≤ 2.6.3) has a vulnerability where the password reset mechanism does not verify that the reset key maps to the targeted user ID. An authenticated attacker who knows a user’s ID can reset that user’s password to an arbitrary value, gaining account access. A pa...

CVE-2021-24655: Authorization Bypass Through User-Controlled Key

The WP User Manager WordPress plugin before 2.6.3 does not ensure that the user ID to reset the password of is related to the reset key given. As a result, any authenticated user can reset the password to an arbitrary value of any user knowing only their ID, and gain access to their account...

PT-2022-9444

Name of the Vulnerable Software and Affected Versions WP User Manager versions prior to 2.6.3 Description The issue allows any authenticated user to reset the password of another user to an arbitrary value, knowing only their ID, and gain access to their account. This is because the plugin does n...

WordPress WP User plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. cross-site scripting vulnerability exists in versions prior to WordPress WP User plugin 7.0. The vulnerability stems...

CVE-2021-25034

The WP User WordPress plugin before 7.0 does not sanitise and escape some parameters in pages where the wpuser shortcode is used, leading to Reflected Cross-Site Scripting issues...

CVE-2021-25034

CVE-2021-25034 affects the WordPress WP User plugin before 7.0. The root cause is lack of sanitisation/escaping of certain parameters in pages using the [wp_user] shortcode, enabling Reflected Cross-Site Scripting (XSS). Public sources (NVD/NVD-derived entries and vendor references) describe a re...

CVE-2021-25034 WP User < 7.0 - Reflected Cross-Site Scripting

The WP User WordPress plugin before 7.0 does not sanitise and escape some parameters in pages where the wpuser shortcode is used, leading to Reflected Cross-Site Scripting issues...

PT-2022-9591

Name of the Vulnerable Software and Affected Versions WP User WordPress plugin versions prior to 7.0 Description The issue arises from the lack of proper sanitization and escaping of certain parameters in pages where the wp user shortcode is used, leading to Reflected Cross-Site Scripting issues...

WordPress plugin 跨站脚本漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. cross-site scripting vulnerability exists in versions prior to WordPress WP User plugin 7.0. The vulnerability stems...

CVE-2021-25034: Improper Neutralization of Input During Web Page Generation

The WP User WordPress plugin before 7.0 does not sanitise and escape some parameters in pages where the wpuser shortcode is used, leading to Reflected Cross-Site Scripting issues...

WordPress WP User plugin <= 6.5.1 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Jeremie Amsellem in WordPress WP User plugin versions = 6.5.1. Solution Update the WordPress WP User plugin to the latest available version at least 7...

WordPress WP User Frontend plugin SQL injection vulnerability

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on PHP and MySQL servers. SQL injection vulnerability exists in versions of the WordPress plugin WP User Frontend prior to 3.5.26, which...

Cross site scripting

The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting...

CVE-2021-25076 WP User Frontend < 3.5.26 - SQL Injection to Reflected Cross-Site Scripting

The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting...

CVE-2021-25076

The WP User Frontend WordPress plugin, versions prior to 3.5.26 , is vulnerable to SQL injection and potentially Reflected Cross-Site Scripting . The root cause is the failure to validate or escape the status parameter before its inclusion in an SQL statement within the Subscribers dashboard . An...

PT-2022-9632

Name of the Vulnerable Software and Affected Versions WP User Frontend WordPress plugin versions prior to 3.5.26 Description The issue arises from the lack of validation and escaping of the status parameter before it is used in a SQL statement in the Subscribers dashboard. This oversight can lead...

CVE-2021-25076: Improper Neutralization of Special Elements used in an SQL Command

The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting...

WP User Manager < 2.6.3 - Arbitrary User Password Reset to Account Compromise

The plugin does not ensure that the user ID to reset the password of is related to the reset key given. As a result, any authenticated user can reset the password to an arbitrary value of any user knowing only their ID, and gain access to their account. User registration must be enabled or you mu...

WordPress WP User Manager 2.0.8 Shell Upload Vulnerability

WordPress WP User Manager plugin version 2.0.8 suffers from a remote shell upload vulnerability. Exploit Title: Wordpress Plugin WP User Manager 2.0.8 - Arbitrary file upload Exploit Author: Mr Winst0n Author E-mail: [email protected] Vendor Homepage: https://wpusermanager.com Software Li...