Vanquish

User Extra Fields

6 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.6

CVE-2025-69376

  • EPSS 0.06%
  • Veröffentlicht 20.02.2026 15:46:52
  • Zuletzt bearbeitet 26.02.2026 20:31:30

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Path Traversal.This issue affects User Extra Fields: from n/a through <= 17.0.

7.7

CVE-2025-69377

  • EPSS 0.05%
  • Veröffentlicht 20.02.2026 15:46:52
  • Zuletzt bearbeitet 25.02.2026 16:23:21

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Path Traversal.This issue affects User Extra Fields: from n/a through <= 17.0.

7.1

CVE-2025-67991

  • EPSS 0.04%
  • Veröffentlicht 20.02.2026 15:46:32
  • Zuletzt bearbeitet 23.02.2026 22:16:17

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Reflected XSS.This issue affects User Extra Fields: from n/a through <= 16.8.

5.3

CVE-2025-67579

  • EPSS 0.04%
  • Veröffentlicht 09.12.2025 14:14:14
  • Zuletzt bearbeitet 20.01.2026 15:19:25

Missing Authorization vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Extra Fields: from n/a through <= 16.8.

9.8

CVE-2024-11150

  • EPSS 17.5%
  • Veröffentlicht 13.11.2024 05:15:12
  • Zuletzt bearbeitet 19.11.2024 16:57:05

The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_tmp_uploaded_file() function in all versions up to, and including, 16.6. This makes it possible for u...

8.8

CVE-2024-10800

  • EPSS 0.24%
  • Veröffentlicht 13.11.2024 05:15:11
  • Zuletzt bearbeitet 19.11.2024 17:08:44

The WordPress User Extra Fields plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the ajax_save_fields() function in all versions up to, and including, 16.6. This makes it possible for authenticated attac...