Ayecode Userswp vulnerabilities
5 known vulnerabilities affecting ayecode/userswp.
Total CVEs
5
CISA KEV
0
Public exploits
1
Exploited in wild
1
Severity breakdown
CRITICAL1HIGH2MEDIUM2
Vulnerabilities
Page 1 of 1
CVE-2024-6265P1CRITICALCVSS 9.8ExploitedPoCfixed in 1.2.112024-06-29
CVE-2024-6265 [CRITICAL] CWE-89 CVE-2024-6265: The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for W
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uwp_sort_by’ parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the e
nvd
CVE-2024-6477P3HIGHCVSS 7.5fixed in 1.2.122024-08-03
CVE-2024-6477 [HIGH] CWE-340 CVE-2024-6477: The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an exp
The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could allow unauthenticated attackers to download them and retrieve sensitive information such as IP, username, and email address
nvd
CVE-2022-47442P3HIGHCVSS 8.8fixed in 1.2.3.102023-11-07
CVE-2022-47442 [HIGH] CWE-1236 CVE-2022-47442: Improper Neutralization of Formula Elements in a CSV File vulnerability in AyeCode Ltd UsersWP.This
Improper Neutralization of Formula Elements in a CSV File vulnerability in AyeCode Ltd UsersWP.This issue affects UsersWP: from n/a through 1.2.3.9.
nvd
CVE-2024-2423P4MEDIUMCVSS 6.4fixed in 1.2.72024-04-09
CVE-2024-2423 [MEDIUM] CWE-79 CVE-2024-2423: The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for W
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it pos
nvd
CVE-2022-0442P4MEDIUMCVSS 4.3fixed in 1.2.3.12022-03-07
CVE-2022-0442 [MEDIUM] CWE-639 CVE-2022-0442: The UsersWP WordPress plugin before 1.2.3.1 is missing access controls when updating a user avatar,
The UsersWP WordPress plugin before 1.2.3.1 is missing access controls when updating a user avatar, and does not make sure file names for user avatars are unique, allowing a logged in user to overwrite another users avatar.
nvd