CVE-2024-9518

CVE-2024-9518 affects the WordPress plugin UserPlus (versions up to 2.0). The issue is unauthenticated privilege escalation caused by insufficient restriction on the functions form_actions and userplus_update_user_profile, allowing an attacker to specify a higher user role via the role parameter ...

CVE-2023-0824

CVE-2023-0824 affects the WordPress plugin “User registration & user profile – UserPlus” (versions

CVE-2024-9519

CVE-2024-9519 affects the WordPress plugin UserPlus (versions up to 2.0). Root cause: an improper capability check in the function save_metabox_form . Impact: authenticated attackers with Editor+ permissions can update the registration form role to Administrator , causing privilege escalation and...

CVE-2024-9520

CVE-2024-9520 refers to the WordPress WordPress UserPlus plugin, with vulnerable versions up to and including 2.0. The root cause is a missing capability check on multiple functions, allowing authenticated users with subscriber-level permissions or higher to add, modify, or delete user meta and p...