Vulnerabilities

TI-2022-00679 CVE-2022-0769 · GHSA-6gqf-mgmr-77r9

Users Ultra <= 3.1.0 - Unauthenticated SQL Injection

MEDIUM 53

The Users Ultra WordPress plugin through 3.1.0 fails to properly sanitize and escape the data_target parameter before it is being interpolated in an SQL statement and then executed via the rating_vote AJAX action (availa…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.08326 Published 2022-04-25 No fix listed CWE-89

TI-2015-07779 CVE-2015-9402 · GHSA-2q2j-6wm8-gx2r

The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload.

MEDIUM 42

The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01965 Published 2019-09-20 No fix listed CWE-434

TI-2015-07772 CVE-2015-9395 · GHSA-6jgm-jq39-vhcg

The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action.

MEDIUM 42

The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01735 Published 2019-09-20 No fix listed CWE-89

TI-2015-07771 CVE-2015-9394 · GHSA-w3hq-3rvc-jpmf

The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php.

LOW 39

The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00671 Published 2019-09-20 No fix listed CWE-352

TI-2015-07770 CVE-2015-9393 · GHSA-mfw2-9hw6-j862

The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter.

LOW 26

The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00709 Published 2019-09-20 No fix listed CWE-79

TI-2015-07769 CVE-2015-9392 · GHSA-vc77-rwwc-jf2g

The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter.

LOW 27

The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01173 Published 2019-09-20 No fix listed CWE-79

TI-2015-03454 CVE-2015-4109 · GHSA-pjj3-h7w2-44v7

Multiple SQL injection vulnerabilities in the ratings module in the Users Ultra plugin…

LOW 37

Multiple SQL injection vulnerabilities in the ratings module in the Users Ultra plugin before 1.5.16 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) data_target or (2) data_vote paramet…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02347 Published 2015-06-09 No fix listed CWE-89

Vulnerabilities

Filters

Users Ultra <= 3.1.0 - Unauthenticated SQL Injection

The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload.

The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action.

The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php.

The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter.

The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter.

Multiple SQL injection vulnerabilities in the ratings module in the Users Ultra plugin…