Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

27 records

Vendor: DeluxeThemes Clear all filters
TI-2025-42129 CVE-2025-68608 · GHSA-j564-h633-q5h9

WordPress Userpro plugin <= 5.1.9 - Broken Access Control vulnerability

Priority LOW 38

Missing Authorization vulnerability in DeluxeThemes Userpro userpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Userpro: from n/a through <= 5.1.9.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0024 Published 2025-12-24 No fix listed CWE-862
TI-2024-11883 CVE-2024-12822 · GHSA-v3v8-4cr7-2w3g

Media Manager for UserPro <= 3.12.0 - Missing Authorization to Unauthenticated Arbitrary Options Update

Priority MEDIUM 50

The Media Manager for UserPro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the add_capto_img() function in all version…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00594 Published 2025-01-30 No fix listed CWE-862
TI-2024-11882 CVE-2024-12821 · GHSA-j4mf-rp8x-w2c3

Media Manager for UserPro <= 3.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update

Priority MEDIUM 40

The Media Manager for UserPro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the upm_upload_media() function in all vers…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00367 Published 2025-01-30 No fix listed CWE-862
TI-2025-16226 CVE-2025-22322 · GHSA-w5hf-f5m8-7wvq

WordPress Private Messages for UserPro plugin <= 4.10.0 - Reflected Cross Site Scripting (XSS) vulnerability

Priority LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DeluxeThemes Private Messages for UserPro userpro-messaging allows Reflected XSS.This issue affects Private Messages f…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00238 Published 2025-01-21 No fix listed CWE-79
TI-2025-16215 CVE-2025-22311 · GHSA-mh65-27wg-9p5h

WordPress Private Messages for UserPro plugin <= 4.10.0 - Local File Inclusion vulnerability

Priority LOW 36

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in DeluxeThemes Private Messages for UserPro userpro-messaging.This issue affects Private Messages for…

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00559 Published 2025-01-21 No fix listed CWE-98
TI-2024-37182 CVE-2024-56212 · GHSA-w3c7-53rc-4cf4

WordPress UserPro plugin <= 5.1.9 - SQL Injection vulnerability

Priority LOW 37

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DeluxeThemes Userpro userpro.This issue affects Userpro: from n/a through <= 5.1.9.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00395 Published 2024-12-31 No fix listed CWE-89
TI-2024-00646 CVE-2024-0701 · GHSA-9hq7-63hh-f94f

UserPro <= 5.1.6 - Disabled Membership Registration Bypass

Priority LOW 31

The UserPro plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 5.1.6.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0058 Published 2024-02-05 No fix listed CWE-602
TI-2023-02292 CVE-2023-2439 · GHSA-pj8j-f4gx-wrgf

Cross-site scripting in UserPro - Community and User Profile WordPress Plugin

Priority LOW 28

The UserPro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userpro' shortcode in versions up to, and including, 5.1.5 due to insufficient input sanitization and output escaping on user supplie…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00332 Published 2024-01-31 No fix listed CWE-79
TI-2023-05536 CVE-2023-6009 · GHSA-vxxj-pw9g-5wxw

UserPro <= 5.1.4 - Authenticated (Subscriber+) Privilege Escalation

Priority MEDIUM 42

The UserPro plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.4 due to insufficient restriction on the 'userpro_update_user_profile' function.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00923 Published 2023-11-22 No fix listed CWE-266
TI-2023-02301 CVE-2023-2449 · GHSA-3vmr-c5f4-vpxf

UserPro <= 5.1.1 - Insecure Password Reset Mechanism

Priority MEDIUM 44

The UserPro plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 5.1.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00894 Published 2023-11-22 No fix listed CWE-620
TI-2023-02290 CVE-2023-2437 · GHSA-w6q9-w8cf-jw9p

UserPro <= 5.1.1 - Authentication Bypass to Administrator

Priority MEDIUM 52

The UserPro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.06746 Published 2023-11-22 No fix listed CWE-288
TI-2023-05534 CVE-2023-6007 · GHSA-v5jp-594g-37v3

UserPro <= 5.1.1 - Missing Authorization via multiple functions

Priority LOW 32

The UserPro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 5.1.1.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00349 Published 2023-11-22 No fix listed CWE-862
TI-2023-02298 CVE-2023-2446 · GHSA-g86m-gmqj-jhhp

UserPro <= 5.1.1 - Sensitive Information Disclosure via Shortcode

Priority LOW 30

The UserPro plugin for WordPress is vulnerable to sensitive information disclosure via the 'userpro' shortcode in versions up to, and including 5.1.1.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00842 Published 2023-11-22 No fix listed CWE-200
Load more