userback

Records2All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

userback records in CISA KEV

No userback vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Userback 1 record LOW

Records

2 records

TI-2023-24742 CVE-2023-46089 · GHSA-5q5q-4pvv-q47c

WordPress Userback Plugin <= 1.0.13 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Lee Le @ Userback Userback plugin <= 1.0.13 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00256 Published 2023-10-22 No fix listed CWE-352

TI-2025-13283 CVE-2025-14540 · GHSA-9452-q4cx-rvq7

Userback <= 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Plugin's Configuration Exposure

LOW 20

The Userback plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the userback_get_json function in all versions up to, and including, 1.0.15.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00243 Published 2025-12-13 No fix listed CWE-862

Open these records in search →

Critical	0
High	1
Medium	1
Low	0
No CVSS	0