Vulnerabilities

TI-2024-22162 CVE-2024-33575 · GHSA-5xxc-3cwr-rgj7

WordPress User Meta plugin <= 3.0 - Sensitive Data Exposure vulnerability

LOW 32

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in User Meta user-meta.This issue affects User Meta: from n/a through 3.0.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01121 Published 2024-04-29 No fix listed CWE-200

TI-2023-09526 CVE-2023-23712 · GHSA-vpfx-rgwp-628j

WordPress User Meta Manager Plugin <= 3.4.9 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in User Meta Manager plugin <= 3.4.9 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00264 Published 2023-05-22 No fix listed CWE-352

TI-2022-00688 CVE-2022-0779 · GHSA-g3g8-hxhq-mfvr

User Meta < 2.4.4 - Subscriber+ Local File Enumeration via Path Traversal

LOW 33

The User Meta WordPress plugin before 2.4.4 does not validate the filepath parameter of its um_show_uploaded_file AJAX action, which could allow low privileged users such as subscriber to enumerate the local files on the…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0236 Published 2022-06-06 Fixed in 2.4.4 CWE-22

TI-2022-00301 CVE-2022-0376 · GHSA-vw5x-4vp3-h26h

User Meta < 2.4.3 - Admin+ Stored Cross-Site Scripting

LOW 23

The User Meta WordPress plugin before 2.4.3 does not sanitise and escape the Form Name, as well as Shared Field Labels before outputting them in the admin dashboard when editing a form, which could allow high privilege u…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00598 Published 2022-05-30 Fixed in 2.4.3 CWE-79

Vulnerabilities

Filters

WordPress User Meta plugin <= 3.0 - Sensitive Data Exposure vulnerability

WordPress User Meta Manager Plugin <= 3.4.9 is vulnerable to Cross Site Request Forgery (CSRF)

User Meta < 2.4.4 - Subscriber+ Local File Enumeration via Path Traversal

User Meta < 2.4.3 - Admin+ Stored Cross-Site Scripting