UserPro - Community and User Profile WordPress Plugin vulnerabilities
We track 5 vulnerabilities in UserPro - Community and User Profile WordPress Plugin products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on November 22, 2023.
Latest UserPro - Community and User Profile WordPress Plugin vulnerabilities
- 8.8 High severity
UserPro - Community and User Profile WordPress…: Incorrect Privilege Assignment
The UserPro plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.4 due to insufficient restriction on the 'userpro_update_user_profile' function. This makes it possible for authenticated attackers, with minimal permi
- 8.8 High severity
UserPro - Community and User Profile WordPress…: Cross-Site Request Forgery
The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0. This is due to missing or incorrect nonce validation on the 'import_settings' function. This makes it possible for unauthenticated attackers t
- 9.8 Critical severity
UserPro - Community and User Profile WordPress…: Unverified Password Change
The UserPro plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 5.1.1. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (userpro_pro
- 8.8 High severity
UserPro - Community and User Profile WordPress…: Cross-Site Request Forgery
The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing nonce validation in the 'admin_page', 'userpro_verify_user' and 'verifyUnverifyAllUsers' functions. This makes it possi
- 8.1 High severity
UserPro - Community and User Profile WordPress…: Improper Authentication
The UserPro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.1. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthen