Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: Wp User Project Clear all filters
TI-2022-03715 CVE-2022-4049 · GHSA-vq28-qp88-5gwg

WP User <= 7.0 - Unauthenticated SQLi

Priority HIGH 82

The WP User WordPress plugin through 7.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0509 Published 2023-01-02 No fix listed
TI-2021-07312 CVE-2021-25034 · GHSA-w334-7ccr-rmv4

WP User < 7.0 - Reflected Cross-Site Scripting

Priority LOW 29

The WP User WordPress plugin before 7.0 does not sanitise and escape some parameters in pages where the [wp_user] shortcode is used, leading to Reflected Cross-Site Scripting issues

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.008 Published 2022-02-28 Fixed in 7.0 CWE-79