CVE-2024-12822 | Critical | 9.8 | 2025-01-30 | The Media Manager for UserPro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing ca… |
CVE-2024-12821 | High | 8.8 | 2025-01-30 | The Media Manager for UserPro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing ca… |
CVE-2024-35700 | Critical | 9.8 | 2024-06-04 | Incorrect Privilege Assignment vulnerability in DeluxeThemes Userpro userpro.This issue affects Userpro: from n/a through <= 5.1.8. |
CVE-2024-0701 | Medium | 5.3 | 2024-02-05 | The UserPro plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 5.1.6. This is due to the use of client-side re… |
CVE-2023-2439 | Medium | 6.4 | 2024-01-31 | The UserPro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userpro' shortcode in versions up to, and including, 5.1.5 due to insuff… |
CVE-2023-6009 | High | 8.8 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.4 due to insufficient restriction on the 'userpro_… |
CVE-2023-6008 | Medium | 6.3 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing or incorrect nonce… |
CVE-2023-6007 | High | 7.3 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple… |
CVE-2023-2497 | High | 8.8 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0. This is due to missing or incorrect nonce… |
CVE-2023-2449 | Critical | 9.8 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 5.1.1. This is due to the plugin using native p… |
CVE-2023-2448 | Medium | 6.5 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'userpro_shortcode_template' function in… |
CVE-2023-2440 | High | 8.8 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing nonce validation i… |
CVE-2023-2438 | Medium | 6.1 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0. This is due to missing or incorrect nonce… |
CVE-2023-2437 | Critical | 9.8 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.1. This is due to insufficient verification on th… |
CVE-2023-2447 | Medium | 6.1 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing or incorrect nonce… |
CVE-2023-2446 | Medium | 6.5 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to sensitive information disclosure via the 'userpro' shortcode in versions up to, and including 5.1.1. This is… |
CVE-2019-14470 | Medium | 6.1 | 2019-09-04 | cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/success.php error_de… |
CVE-2018-16285 | Medium | 6.1 | 2018-09-06 | The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userpro_shortcode_template action to wp-admin/admin-ajax.php. |
CVE-2017-16562 | Critical | 9.8 | 2017-11-10 | The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentication and obtain ad… |