Usersultra

Records7All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high4CVSS 7.0–8.9

Exploited now

Usersultra records in CISA KEV

No Usersultra vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

5 records in Users Ultra Membership · all components

TI-2015-07779 CVE-2015-9402 · GHSA-2q2j-6wm8-gx2r

MEDIUM 42

The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01965 Published 2019-09-20 No fix listed CWE-434

TI-2015-07772 CVE-2015-9395 · GHSA-6jgm-jq39-vhcg

MEDIUM 42

The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01735 Published 2019-09-20 No fix listed CWE-89

TI-2015-07771 CVE-2015-9394 · GHSA-w3hq-3rvc-jpmf

LOW 39

The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00671 Published 2019-09-20 No fix listed CWE-352

TI-2015-07769 CVE-2015-9392 · GHSA-vc77-rwwc-jf2g

LOW 27

The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01173 Published 2019-09-20 No fix listed CWE-79

TI-2015-07770 CVE-2015-9393 · GHSA-mfw2-9hw6-j862

LOW 26

The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00709 Published 2019-09-20 No fix listed CWE-79