CVE-2024-6265

CVE-2024-6265 affects the WordPress plugin UsersWP (Front-end login, registration, profile, members directory). The vulnerability is a time-based SQL Injection caused by insufficient escaping of the uwp_sort_by parameter in all versions up to and including 1.2.10 , allowing unauthenticated attack...

CVE-2022-0442

CVE-2022-0442 affects the WordPress plugin UsersWP (versions prior to 1.2.3.1). The issue is a lack of access controls when updating a user avatar and non-unique avatar filenames, enabling a logged-in user to overwrite another user’s avatar. The vulnerability is confirmed across multiple sources ...

CVE-2024-2423

CVE-2024-2423 affects the WordPress plugin UsersWP – Front-end login form, User Registration, User Profile & Members Directory . It is vulnerable to Stored Cross-Site Scripting via the plugin’s shortcode attributes in all versions up to and including 1.2.6, due to insufficient input sanitization ...

CVE-2022-47442

CVE-2022-47442 affects the WordPress UsersWP plugin (versions

CVE-2024-6477

The UsersWP WordPress plugin (versions prior to 1.2.12 ) is vulnerable to sensitive data exposure. The root cause is the use of predictable filenames when an administrator generates an export, which allows unauthenticated attackers to download files and retrieve sensitive information such as IP a...