UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP

Уязвимости

• CVE-2024-6265без авторизации≤ 1.2.10

  UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress <= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort

  Критич. 9.8

• CVE-2026-13492подписчик+≤ 1.2.65

  UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field

  Высокий 8.8

• CVE-2022-47442нужен вход≤ 1.2.3.9

  WordPress UsersWP Plugin <= 1.2.3.9 is vulnerable to CSV Injection

  Высокий 8.8

• CVE-2026-19991подписчик+≤ 1.2.70

  UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion

  Высокий 8.1

• CVE-2025-10003подписчик+≤ 1.2.44

  UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.44 - Authenticated (Subscriber+) SQL Injection

  Средний 6.5

• CVE-2026-5742подписчик+≤ 1.2.60

  UsersWP <= 1.2.60 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link Substitution

  Средний 6.4

• CVE-2025-9344участник+≤ 1.2.42

  UsersWP <= 1.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Средний 6.4

• CVE-2024-2423участник+≤ 1.2.6

  UsersWP <= 1.2.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode

  Средний 6.4

• CVE-2024-31936без авторизации · нужен клик→ 1.2.6

  WordPress UsersWP plugin < 1.2.6 - Cross Site Request Forgery (CSRF) vulnerability

  Средний 5.4

• CVE-2025-66072без авторизации≤ 1.2.47

  WordPress UsersWP plugin <= 1.2.47 - Broken Access Control vulnerability

  Средний 5.3

• CVE-2024-43277без авторизации≤ 1.2.15

  WordPress UsersWP plugin <= 1.2.15 - Broken Access Control vulnerability

  Средний 5.3

• CVE-2026-4979подписчик+≤ 1.2.58

  UsersWP <= 1.2.58 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter

  Средний 5.0

• CVE-2026-25015без авторизации · нужен клик≤ 1.2.53

  WordPress UsersWP plugin <= 1.2.53 - Cross Site Request Forgery (CSRF) vulnerability

  Средний 4.3

• CVE-2025-67593без авторизации · нужен клик≤ 1.2.48

  WordPress UsersWP plugin <= 1.2.48 - Cross Site Request Forgery (CSRF) vulnerability

  Средний 4.3

• CVE-2026-4977подписчик+≤ 1.2.58

  UsersWP <= 1.2.58 - Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter

  Средний 4.3

• CVE-2026-12102редактор+≤ 1.2.63

  UsersWP <= 1.2.63 - Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user_id' Parameter

  Низкий 2.7