Read the docs

User Meta

Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

User Meta records in CISA KEV

No User Meta vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
User Meta User Profile Builder And User Management 2 records LOW User Meta Manager 1 record LOW

Records

4 records

TI-2022-00688 CVE-2022-0779 · GHSA-g3g8-hxhq-mfvr

User Meta < 2.4.4 - Subscriber+ Local File Enumeration via Path Traversal

Priority LOW 33

The User Meta WordPress plugin before 2.4.4 does not validate the filepath parameter of its um_show_uploaded_file AJAX action, which could allow low privileged users such as subscriber to enumerate the local files on the…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0236 Published 2022-06-06 Fixed in 2.4.4 CWE-22
TI-2022-00301 CVE-2022-0376 · GHSA-vw5x-4vp3-h26h

User Meta < 2.4.3 - Admin+ Stored Cross-Site Scripting

Priority LOW 23

The User Meta WordPress plugin before 2.4.3 does not sanitise and escape the Form Name, as well as Shared Field Labels before outputting them in the admin dashboard when editing a form, which could allow high privilege u…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00598 Published 2022-05-30 Fixed in 2.4.3 CWE-79
Open these records in search →