Vulnerabilities > Userproplugin

DATE CVE VULNERABILITY TITLE RISK
2024-06-04 CVE-2024-35700 Unspecified vulnerability in Userproplugin Userpro
Improper Privilege Management vulnerability in DeluxeThemes Userpro allows Privilege Escalation.This issue affects Userpro: from n/a through 5.1.8.
network
low complexity
userproplugin
critical
9.8
2024-02-05 CVE-2024-0701 Unspecified vulnerability in Userproplugin Userpro
The UserPro plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 5.1.6.
network
low complexity
userproplugin
5.3
2024-01-31 CVE-2023-2439 Cross-site Scripting vulnerability in Userproplugin Userpro
The UserPro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userpro' shortcode in versions up to, and including, 5.1.5 due to insufficient input sanitization and output escaping on user supplied attributes.
network
low complexity
userproplugin CWE-79
5.4
2023-11-22 CVE-2023-2437 Improper Authentication vulnerability in Userproplugin Userpro
The UserPro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.1.
network
high complexity
userproplugin CWE-287
8.1
2023-11-22 CVE-2023-2438 Cross-Site Request Forgery (CSRF) vulnerability in Userproplugin Userpro
The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0.
network
low complexity
userproplugin CWE-352
6.1
2023-11-22 CVE-2023-2440 Cross-Site Request Forgery (CSRF) vulnerability in Userproplugin Userpro
The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1.
network
low complexity
userproplugin CWE-352
8.8
2023-11-22 CVE-2023-2448 Missing Authorization vulnerability in Userproplugin Userpro
The UserPro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'userpro_shortcode_template' function in versions up to, and including, 5.1.4.
network
low complexity
userproplugin CWE-862
5.3
2023-11-22 CVE-2023-2449 Unspecified vulnerability in Userproplugin Userpro
The UserPro plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 5.1.1.
network
low complexity
userproplugin
critical
9.8
2023-11-22 CVE-2023-2497 Cross-Site Request Forgery (CSRF) vulnerability in Userproplugin Userpro
The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0.
network
low complexity
userproplugin CWE-352
8.8
2023-11-22 CVE-2023-6007 Missing Authorization vulnerability in Userproplugin Userpro
The UserPro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 5.1.1.
network
low complexity
userproplugin CWE-862
6.5