User Session Synchronizer vulnerabilities

2 known vulnerabilities in User Session Synchronizer from Rafasashi. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  User Session Synchronizer: Improper Authentication

  CVE-2026-15341Aug 15, 2026Rafasashi

  The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4.0. The `synchronize_session()` function, hooked on `init` and therefore executed on every request, p

• 7.1 High severity

  User Session Synchronizer: Cross-Site Request Forgery

  CVE-2025-32612Apr 9, 2025Rafasashi

  Cross-Site Request Forgery (CSRF) vulnerability in rafasashi User Session Synchronizer user-session-synchronizer allows Stored XSS.This issue affects User Session Synchronizer: from n/a through <= 1.4.0.