Userpro vulnerabilities
5 known vulnerabilities in Userpro from Userproplugin. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
UserPro - Community and User Profile WordPress…: Incorrect Privilege Assignment
The UserPro plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.4 due to insufficient restriction on the 'userpro_update_user_profile' function. This makes it possible for authenticated attackers, with minimal permi
- 8.8 High severity
UserPro - Community and User Profile WordPress…: Cross-Site Request Forgery
The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0. This is due to missing or incorrect nonce validation on the 'import_settings' function. This makes it possible for unauthenticated attackers t
- 9.8 Critical severity
UserPro - Community and User Profile WordPress…: Unverified Password Change
The UserPro plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 5.1.1. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (userpro_pro
- 8.8 High severity
UserPro - Community and User Profile WordPress…: Cross-Site Request Forgery
The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing nonce validation in the 'admin_page', 'userpro_verify_user' and 'verifyUnverifyAllUsers' functions. This makes it possi
- 8.1 High severity
UserPro - Community and User Profile WordPress…: Improper Authentication
The UserPro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.1. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthen