Read the docs

Wp User Project

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

Wp User Project records in CISA KEV

No Wp User Project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Wp User 2 records HIGH

Records

2 records

TI-2022-03715 CVE-2022-4049 · GHSA-vq28-qp88-5gwg

WP User <= 7.0 - Unauthenticated SQLi

Priority HIGH 82

The WP User WordPress plugin through 7.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0509 Published 2023-01-02 No fix listed
TI-2021-07312 CVE-2021-25034 · GHSA-w334-7ccr-rmv4

WP User < 7.0 - Reflected Cross-Site Scripting

Priority LOW 29

The WP User WordPress plugin before 7.0 does not sanitise and escape some parameters in pages where the [wp_user] shortcode is used, leading to Reflected Cross-Site Scripting issues

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.008 Published 2022-02-28 Fixed in 7.0 CWE-79
Open these records in search →