Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: AyeCode Ltd Component: Userswp Clear all filters
TI-2024-06008 CVE-2024-6477 · GHSA-jrj5-pj64-4f42

UsersWP < 1.2.12 - Users Information Disclosure

Priority HIGH 66

The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could allow unauthenticated attackers to download them and retrieve sensitive information such as IP, usernam…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00575 Published 2024-08-03 Fixed in 1.2.12
TI-2024-05812 CVE-2024-6265 · GHSA-9x7p-g38x-wwhv

SQL injection in stiofansisland UsersWP – Front-end login form, User Registration, User…

Priority MEDIUM 53

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uwp_sort_by’ parameter in all versions…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02381 Published 2024-06-29 No fix listed CWE-89
TI-2024-02251 CVE-2024-2423 · GHSA-2726-6rmv-hf9g

UsersWP <= 1.2.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode

Priority LOW 29

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00446 Published 2024-04-09 No fix listed CWE-79
TI-2022-23519 CVE-2022-47442 · GHSA-vfrw-m2c3-hh6g

WordPress UsersWP Plugin <= 1.2.3.9 is vulnerable to CSV Injection

Priority MEDIUM 41

Improper Neutralization of Formula Elements in a CSV File vulnerability in AyeCode Ltd UsersWP.This issue affects UsersWP: from n/a through 1.2.3.9.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00682 Published 2023-11-07 No fix listed CWE-1236
TI-2022-00365 CVE-2022-0442 · GHSA-37f6-m354-672c

UsersWP < 1.2.3.1 - Subscriber+ User Avatar Override

Priority LOW 21

The UsersWP WordPress plugin before 1.2.3.1 is missing access controls when updating a user avatar, and does not make sure file names for user avatars are unique, allowing a logged in user to overwrite another users avat…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00654 Published 2022-03-07 Fixed in 1.2.3.1 CWE-639