Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: Wp User Merger Project Clear all filters
TI-2022-03543 CVE-2022-3865 · GHSA-9ff9-jpcp-gg2m

WP User Merger < 1.5.3 - Admin+ SQLi via ID

Priority HIGH 73

The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01172 Published 2022-11-28 Fixed in 1.5.3
TI-2022-03528 CVE-2022-3848 · GHSA-fp36-pmr8-vj9p

WP User Merger < 1.5.3 - Admin+ SQLi via wpsu_user_id

Priority HIGH 73

The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01172 Published 2022-11-28 Fixed in 1.5.3 CWE-89
TI-2022-03529 CVE-2022-3849 · GHSA-3g68-h29c-7326

WP User Merger < 1.5.3 - Admin+ SQLi via user_id

Priority HIGH 73

The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01172 Published 2022-11-28 Fixed in 1.5.3