Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

2 records

Vendor: User Meta Component: User Meta User Profile Builder And User Management Clear all filters
TI-2022-00688 CVE-2022-0779 · GHSA-g3g8-hxhq-mfvr

User Meta < 2.4.4 - Subscriber+ Local File Enumeration via Path Traversal

Priority LOW 33

The User Meta WordPress plugin before 2.4.4 does not validate the filepath parameter of its um_show_uploaded_file AJAX action, which could allow low privileged users such as subscriber to enumerate the local files on the…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0236 Published 2022-06-06 Fixed in 2.4.4 CWE-22
TI-2022-00301 CVE-2022-0376 · GHSA-vw5x-4vp3-h26h

User Meta < 2.4.3 - Admin+ Stored Cross-Site Scripting

Priority LOW 23

The User Meta WordPress plugin before 2.4.3 does not sanitise and escape the Form Name, as well as Shared Field Labels before outputting them in the admin dashboard when editing a form, which could allow high privilege u…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00598 Published 2022-05-30 Fixed in 2.4.3 CWE-79