8 matches found
CVE-2023-3342
The CVE-2023-3342 entry concerns the WordPress User Registration plugin (versions ≤ 3.0.2). The vulnerability arises from a hardcoded encryption key and missing file type validation in the ur_upload_profile_pic function, allowing authenticated users with subscriber-level privileges or higher to u...
CVE-2025-1511
CVE-2025-1511 refers to a Reflected Cross-Site Scripting vulnerability in the WordPress plugin “User Registration & Membership – Custom Registration Form, Login Form, and User Profile” affecting all versions up to 4.0.4. The Red Hat entry corroborates that the flaw arises from insufficient input ...
CVE-2023-3343
The CVE-2023-3343 issue affects the WordPress User Registration plugin (versions up to 3.0.1). It enables PHP Object Injection through deserialization of untrusted input from the profile-pic-url parameter. Exploitation requires authenticated access at subscriber level or higher; a successful atta...
CVE-2022-3912
CVE-2022-3912 affects the WordPress plugin User Registration (versions prior to 2.2.4.1). The root cause is that the plugin does not properly restrict files uploaded via an AJAX action available to both unauthenticated and authenticated users, enabling unauthenticated users to upload PHP files. I...
CVE-2023-5228
CVE-2023-5228 affects the WordPress plugin “User Registration” prior to version 3.0.4.2. The vulnerability stems from improper sanitization/escaping of certain plugin settings, enabling stored XSS by high-privilege users (e.g., administrators) even when unfiltered_html is disallowed (notably in m...
CVE-2023-29429
CVE-2023-29429 describes a Missing Authorization/Broken Access Control vulnerability in the WordPress User Registration plugin (versions
CVE-2021-24654
CVE-2021-24654 affects the WordPress plugin User Registration (before 2.0.2). The vulnerability arises because user_registration_profile_pic_url is not properly sanitised when submitted via the user_registration_update_profile_details AJAX action, allowing any authenticated user (e.g., a subscrib...