CVE-2023-0824

The User registration & user profile WordPress plugin, affecting versions through 2.0 , is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to missing CSRF checks in certain areas. Furthermore, the plugin lacks proper sanitization and escaping , which could allow an attacker to trick ...

CVE-2024-9519

CVE-2024-9519 affects the WordPress plugin UserPlus (versions up to 2.0). Root cause: an improper capability check in the function save_metabox_form . Impact: authenticated attackers with Editor+ permissions can update the registration form role to Administrator , causing privilege escalation and...