Userproplugin vulnerabilities
We track 6 vulnerabilities in Userproplugin products across 2 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on January 30, 2025.
Latest Userproplugin vulnerabilities
- 9.8 Critical severity
Media Manager for UserPro: Missing Authorization
The Media Manager for UserPro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the add_capto_img() function in all versions up to, and including, 3.11.0. This mak
- 8.8 High severity
UserPro - Community and User Profile WordPress…: Incorrect Privilege Assignment
The UserPro plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.4 due to insufficient restriction on the 'userpro_update_user_profile' function. This makes it possible for authenticated attackers, with minimal permi
- 8.8 High severity
UserPro - Community and User Profile WordPress…: Cross-Site Request Forgery
The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0. This is due to missing or incorrect nonce validation on the 'import_settings' function. This makes it possible for unauthenticated attackers t
- 9.8 Critical severity
UserPro - Community and User Profile WordPress…: Unverified Password Change
The UserPro plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 5.1.1. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (userpro_pro
- 8.8 High severity
UserPro - Community and User Profile WordPress…: Cross-Site Request Forgery
The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing nonce validation in the 'admin_page', 'userpro_verify_user' and 'verifyUnverifyAllUsers' functions. This makes it possi
- 8.1 High severity
UserPro - Community and User Profile WordPress…: Improper Authentication
The UserPro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.1. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthen