Ayecode

Userswp

7 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.3

CVE-2024-43277

  • EPSS 0.1%
  • Published 01.11.2024 15:15:44
  • Last modified 01.11.2024 20:24:53

Missing Authorization vulnerability in AyeCode Ltd UsersWP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.15.

7.5

CVE-2024-6477

Exploit
  • EPSS 0.3%
  • Published 03.08.2024 06:16:29
  • Last modified 22.08.2025 09:15:33

The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could allow unauthenticated attackers to download them and retrieve sensitive information such as IP, username, and email address

9.8

CVE-2024-6265

  • EPSS 1.48%
  • Published 29.06.2024 05:15:03
  • Last modified 21.11.2024 09:49:18

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uwp_sort_by’ parameter in all versions up to, and including, 1.2.10 d...

5.4

CVE-2024-31936

  • EPSS 0.1%
  • Published 11.04.2024 13:15:55
  • Last modified 21.11.2024 09:14:09

Cross-Site Request Forgery (CSRF) vulnerability in AyeCode Ltd UsersWP.This issue affects UsersWP: from n/a before 1.2.6.

6.4

CVE-2024-2423

  • EPSS 0.17%
  • Published 09.04.2024 19:15:33
  • Last modified 29.09.2025 21:58:03

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.2.6 d...

8.8

CVE-2022-47442

  • EPSS 0.69%
  • Published 07.11.2023 15:15:10
  • Last modified 21.11.2024 07:31:58

Improper Neutralization of Formula Elements in a CSV File vulnerability in AyeCode Ltd UsersWP.This issue affects UsersWP: from n/a through 1.2.3.9.

4.3

CVE-2022-0442

Exploit
  • EPSS 0.15%
  • Published 07.03.2022 09:15:09
  • Last modified 21.11.2024 06:38:38

The UsersWP WordPress plugin before 1.2.3.1 is missing access controls when updating a user avatar, and does not make sure file names for user avatars are unique, allowing a logged in user to overwrite another users avatar.