CVE-2022-0779

CVE-2022-0779 affects the WordPress plugin User Meta (before 2.4.4). The vulnerability stems from the Ajax action um_show_uploaded_file not validating the filepath parameter, enabling a low-privilege user (e.g., subscriber) to perform path traversal and enumerate local server files. The Red Hat a...

CVE-2022-0376

CVE-2022-0376 affects WordPress User Meta plugin prior to 2.4.3. The vulnerability arises from failing to sanitize/escape the Form Name and Shared Field Labels in the admin form editor, enabling stored XSS by high-privilege users even when unfiltered_html is disallowed. Red Hat and CVE listings c...