Vendors / Usersultra Records 7 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 1
CVSS high 4
Exploited now Usersultra records in CISA KEV No Usersultra vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 53
The Users Ultra WordPress plugin through 3.1.0 fails to properly sanitize and escape the data_target parameter before it is being interpolated in an SQL statement and then executed via the rating_vote AJAX action (availa…
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.08326 · Published 2022-04-25 · No fix listed CWE-89
Priority MEDIUM 42
The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload.
CVSS 3.1 HIGH 8.8· Network · No auth · User interaction · EPSS 0.01965 · Published 2019-09-20 · No fix listed CWE-434
Priority MEDIUM 42
The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01735 · Published 2019-09-20 · No fix listed CWE-89
Priority LOW 39
The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php.
CVSS 3.1 HIGH 8.8· Network · No auth · User interaction · EPSS 0.00671 · Published 2019-09-20 · No fix listed CWE-352
Priority LOW 37
Multiple SQL injection vulnerabilities in the ratings module in the Users Ultra plugin before 1.5.16 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) data_target or (2) data_vote paramet…
CVSS 2.0 HIGH 7.5· Network · No auth · Interaction — · EPSS 0.02347 · Published 2015-06-09 · No fix listed CWE-89
Priority LOW 27
The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.01173 · Published 2019-09-20 · No fix listed CWE-79
Priority LOW 26
The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00709 · Published 2019-09-20 · No fix listed CWE-79
Open these records in search → All records by CVSS severity
1 4 2 0 0
THREATIST.IORead the docs