Vulnerabilities

TI-2015-07779 CVE-2015-9402 · GHSA-2q2j-6wm8-gx2r

The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload.

MEDIUM 42

The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01965 Published 2019-09-20 No fix listed CWE-434

TI-2015-07772 CVE-2015-9395 · GHSA-6jgm-jq39-vhcg

MEDIUM 42

The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01735 Published 2019-09-20 No fix listed CWE-89

TI-2015-07771 CVE-2015-9394 · GHSA-w3hq-3rvc-jpmf

LOW 39

The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00671 Published 2019-09-20 No fix listed CWE-352

TI-2015-07770 CVE-2015-9393 · GHSA-mfw2-9hw6-j862

LOW 26

The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00709 Published 2019-09-20 No fix listed CWE-79

TI-2015-07769 CVE-2015-9392 · GHSA-vc77-rwwc-jf2g

LOW 27

The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01173 Published 2019-09-20 No fix listed CWE-79