CVE-2024-9518

CVE-2024-9518 affects the WordPress plugin UserPlus (versions up to 2.0). The issue is unauthenticated privilege escalation caused by insufficient restriction on the functions form_actions and userplus_update_user_profile, allowing an attacker to specify a higher user role via the role parameter ...

CVE-2023-0824

The UserPlus (User registration & user profile) WordPress plugin versions through 2.0 is vulnerable to a Stored XSS attack. The root cause is a lack of CSRF checks in specific areas, combined with missing sanitization and escaping . This allows an attacker to perform a CSRF attack to trick a logg...

CVE-2024-9520

CVE-2024-9520 refers to the WordPress WordPress UserPlus plugin, with vulnerable versions up to and including 2.0. The root cause is a missing capability check on multiple functions, allowing authenticated users with subscriber-level permissions or higher to add, modify, or delete user meta and p...

CVE-2024-9519

CVE-2024-9519 affects the WordPress plugin UserPlus (versions up to 2.0). Root cause: an improper capability check in the function save_metabox_form . Impact: authenticated attackers with Editor+ permissions can update the registration form role to Administrator , causing privilege escalation and...