Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: weDevs Component: Wp User Frontend Clear all filters
TI-2024-25927 CVE-2024-38693 · GHSA-hw2c-64gc-7jv5

WordPress WP User Frontend plugin <= 4.0.7 - SQL Injection vulnerability

Priority LOW 34

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP User Frontend allows SQL Injection.This issue affects WP User Frontend: from n/a through 4.0.7.

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00438 Published 2024-08-29 No fix listed CWE-89
TI-2021-06932 CVE-2021-24649 · GHSA-f4mf-54pp-jfrw

WP User Frontend < 3.5.29 - Obscure Registration as Admin

Priority HIGH 82

The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpuf_encryption().

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00706 Published 2022-11-21 Fixed in 3.5.29
TI-2021-07354 CVE-2021-25076 · GHSA-gx4g-7h78-x658

WP User Frontend < 3.5.26 - SQL Injection to Reflected Cross-Site Scripting

Priority MEDIUM 55

The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.17255 Published 2022-01-24 Fixed in 3.5.26 CWE-89