CVE-2023-2446

The UserPro plugin for WordPress is vulnerable to sensitive information disclosure in versions up to and including 5.1.1 . The root cause is insufficient restriction on sensitive user meta values that can be accessed via the 'userpro' shortcode . This allows authenticated attackers with subscribe...

CVE-2023-2447

CVE-2023-2447 affects the WordPress UserPro plugin (up to v5.1.1). Root cause: CSRF due to missing/incorrect nonce validation in export_users, allowing unauthenticated export of users to CSV if a site admin is tricked. Mitigation: update to v5.1.2 (patch).

CVE-2017-16562

The UserPro plugin for WordPress (versions prior to 4.9.17.1 ) is vulnerable to a remote authentication bypass . When a site uses the default "admin" username, a remote unauthenticated attacker can obtain administrative access by appending ?up_auto_log=true to the QUERY_STRING of the default URI....

CVE-2024-35700

A critical Incorrect Privilege Assignment vulnerability exists in the DeluxeThemes Userpro WordPress plugin, affecting versions through

CVE-2023-2439

The CVE-2023-2439 issue affects the WordPress UserPro plugin (version range up to 5.1.5). The root cause is insufficient input sanitization and output escaping on attributes passed to the userpro shortcode, enabling Stored Cross-Site Scripting. The vulnerability requires authentication with contr...