CVE-2023-2437

The UserPro plugin for WordPress is vulnerable to an authentication bypass in versions up to and including 5.1.1 . The root cause is insufficient verification of the user supplied during a Facebook login through the plugin, specifically via the userpro_fbconnect AJAX action. This flaw allows unau...

CVE-2023-2446

The UserPro plugin for WordPress is vulnerable to sensitive information disclosure in versions up to and including 5.1.1 . The root cause is insufficient restriction on sensitive user meta values that can be accessed via the 'userpro' shortcode . This allows authenticated attackers with subscribe...

CVE-2023-6009

CVE-2023-6009 : The WordPress UserPro plugin (versions up to 5.1.4) is vulnerable to privilege escalation due to insufficient restriction of the function userpro_update_user_profile. An authenticated user with minimal permissions (e.g., a subscriber) can modify their own role by supplying the wp_...

CVE-2023-2448

CVE-2023-2448 concerns the WordPress UserPro plugin. Affected versions are up to and including 5.1.4, where a missing capability check in the function userpro_shortcode_template allows unauthenticated attackers to perform arbitrary shortcode execution and unauthorized data access. The incident is...

CVE-2023-2497

CVE-2023-2497 affects the UserPro WordPress plugin up to version 5.1.0. It is a Cross-Site Request Forgery (CSRF) vulnerability stemming from missing or incorrect nonce validation on the import_settings function, which, when combined with unserialize() on user-supplied data, can enable unauthenti...

CVE-2023-2440

CVE-2023-2440 (UserPro WordPress Plugin) affects version up to 5.1.1 and is a CSRF vulnerability due to missing nonce validation in admin_page, userpro_verify_user, and verifyUnverifyAllUsers. This allows unauthenticated attackers to modify verified users’ roles, potentially elevating privileges ...

CVE-2023-2449

The CVE-2023-2449 issue concerns the WordPress UserPro plugin. Concrete details from connected sources show that versions up to 5.1.1 are affected by an unauthorized password-reset flaw due to the plugin using plaintext reset keys (userpro_process_form) instead of a hashed value, enabling misuse ...

CVE-2023-2447

CVE-2023-2447 affects the WordPress UserPro plugin (up to v5.1.1). Root cause: CSRF due to missing/incorrect nonce validation in export_users, allowing unauthenticated export of users to CSV if a site admin is tricked. Mitigation: update to v5.1.2 (patch).

CVE-2023-2438

CVE-2023-2438 : A CSRF flaw in the WordPress plugin UserPro (WordPress,

CVE-2023-6007

CVE-2023-6007 affects the WordPress plugin UserPro – Community and User Profile WordPress Plugin . Root cause: a missing capability check on multiple functions in all versions up to 5.1.1, allowing unauthenticated attackers to perform data access and manipulation. Impact (as stated): attackers ca...

CVE-2023-6008

CVE-2023-6008 is a CSRF vulnerability in the WordPress UserPro plugin (

CVE-2017-16562

The UserPro plugin for WordPress (versions prior to 4.9.17.1 ) is vulnerable to a remote authentication bypass . When a site uses the default "admin" username, a remote unauthenticated attacker can obtain administrative access by appending ?up_auto_log=true to the QUERY_STRING of the default URI....

CVE-2024-35700

A critical Incorrect Privilege Assignment vulnerability exists in the DeluxeThemes Userpro WordPress plugin, affecting versions through

CVE-2023-2439

The CVE-2023-2439 issue affects the WordPress UserPro plugin (version range up to 5.1.5). The root cause is insufficient input sanitization and output escaping on attributes passed to the userpro shortcode, enabling Stored Cross-Site Scripting. The vulnerability requires authentication with contr...

CVE-2024-0701

CVE-2024-0701 concerns the WordPress UserPro plugin. The vulnerability is described as a Security Feature Bypass caused by relying on client-side restrictions to enforce the Disable Registration setting, enabling unauthenticated attackers to create accounts even when registration is disabled. Dat...

CVE-2018-16285

CVE-2018-16285 affects the WordPress WordPress UserPro premium plugin up to version 4.9.23. The vulnerability is an XSS in the shortcode handling: attacker-supplied content passed to the userpro_shortcode_template action is reflected into wp-admin/admin-ajax.php, enabling cross-site scripting. Im...