CVE-2016-20075 | High | 8.8 | 2026-06-15 | WordPress Ultimate Product Catalog 3.8.6 contains an arbitrary file upload vulnerability that allows authenticated users with contributor, editor, author, or a… |
CVE-2021-47924 | Medium | 6.4 | 2026-05-10 | Ultimate Product Catalogue 5.8.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through t… |
CVE-2025-47580 | Medium | 5.4 | 2025-05-15 | Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2024-13569 | High | 7.1 | 2025-04-22 | The Front End Users WordPress plugin through 3.2.32 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cros… |
CVE-2025-2005 | Critical | 9.8 | 2025-04-02 | The Front End Users plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the file uploads field of the registrat… |
CVE-2024-12410 | Medium | 4.9 | 2025-04-02 | The Front End Users plugin for WordPress is vulnerable to SQL Injection via the 'UserSearchField' parameter in all versions up to, and including, 3.2.32 due to… |
CVE-2025-26877 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Front End Users front-end-only-users allows St… |
CVE-2024-13563 | Medium | 6.4 | 2025-02-15 | The Front End Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's forgot-password shortcode in all versions up to, and inc… |
CVE-2024-43343 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in Etoile Web Design Order Tracking allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Orde… |
CVE-2024-7607 | High | 8.8 | 2024-08-29 | The Front End Users plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.2.28 due t… |
CVE-2024-7606 | Medium | 6.4 | 2024-08-29 | The Front End Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'user-search' shortcode in all versions up to, and inclu… |
CVE-2023-33322 | High | 7.1 | 2024-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Etoile Web Design Front End Users allows Reflected XSS.Th… |
CVE-2024-25597 | High | 7.1 | 2024-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Etoile Web Design Ultimate Reviews allows Stored XSS.This… |
CVE-2023-4500 | Medium | 4.7 | 2023-08-31 | The Order Tracking Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the order status parameter in versions up to, and including, 3.3.6… |
CVE-2023-4471 | Medium | 6.1 | 2023-08-31 | The Order Tracking Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the start_date and end_date parameters in versions up to, and i… |
CVE-2023-34005 | Medium | 6.5 | 2023-07-17 | Cross-Site Request Forgery (CSRF) vulnerability in Etoile Web Design Front End Users plugin <= 3.2.24 versions. |
CVE-2023-2711 | Medium | 4.8 | 2023-06-27 | The Ultimate Product Catalog WordPress plugin before 5.2.6 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2020-36726 | Critical | 9.8 | 2023-06-07 | The Ultimate Reviews plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.1.32 via deserialization of untrusted input… |
CVE-2021-24993 | Medium | 6.5 | 2022-02-07 | The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX actions, which could allow any authenticat… |
CVE-2022-23979 | Medium | 4.8 | 2022-01-28 | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in Ultimate Reviews WordPress plugin (versions <= 3.0.15). |
CVE-2021-24968 | Medium | 5.7 | 2022-01-24 | The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome_add_faq_page AJAX… |
CVE-2020-24313 | Medium | 6.1 | 2020-08-26 | Etoile Web Design Ultimate Appointment Booking & Scheduling WordPress Plugin v1.1.9 and lower does not sanitize the value of the "Appointment_ID" GET parameter… |
CVE-2020-7107 | Medium | 6.1 | 2020-01-16 | The Ultimate FAQ plugin before 1.8.30 for WordPress allows XSS via Display_FAQ to Shortcodes/DisplayFAQs.php. |
CVE-2019-17233 | Medium | 6.1 | 2019-10-07 | Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection. |
CVE-2019-17232 | High | 7.5 | 2019-10-07 | Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import. |
CVE-2019-15643 | Medium | 6.1 | 2019-08-27 | The ultimate-faqs plugin before 1.8.22 for WordPress has XSS. |
CVE-2017-12200 | Medium | 6.1 | 2017-08-02 | The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has XSS in the Add Product Manually component. |
CVE-2017-12199 | Critical | 9.8 | 2017-08-02 | The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogue_update_order list-… |