AyeCode Ltd UsersWP vulnerabilities

Latest AyeCode Ltd UsersWP CVEs

Newest publication first

1. CVE-2024-43277 WordPress UsersWP plugin <= 1.2.15 - Broken Access Control vulnerability

   Published 2024-11-01

   Medium·CVSS 5.3 EPSS 0.40%

   Missing Authorization vulnerability in AyeCode Ltd UsersWP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.15.

2. CVE-2024-6477 UsersWP < 1.2.12 - Users Information Disclosure

   Published 2024-08-03

   High·CVSS 7.5 EPSS 0.58%

   The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could allow unauthenticated attackers to download them and retrieve sensitive information such as IP, username, and email address

3. CVE-2024-6265 UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress <= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort_by'

   Published 2024-06-29

   Critical·CVSS 9.8 EPSS 2.4%

   The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uwp_sort_by’ parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on...

4. CVE-2024-31936 WordPress UsersWP plugin < 1.2.6 - Cross Site Request Forgery (CSRF) vulnerability

   Published 2024-04-11

   Medium·CVSS 5.4 EPSS 0.20%

   Cross-Site Request Forgery (CSRF) vulnerability in AyeCode Ltd UsersWP.This issue affects UsersWP: from n/a before 1.2.6.

5. CVE-2024-2423 UsersWP <= 1.2.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode

   Published 2024-04-09

   Medium·CVSS 6.4 EPSS 0.45%

   The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.2.6 due to insufficient input sanit...

6. CVE-2022-47442 WordPress UsersWP Plugin <= 1.2.3.9 is vulnerable to CSV Injection

   Published 2023-11-07

   High·CVSS 8.8 EPSS 0.86%

   Improper Neutralization of Formula Elements in a CSV File vulnerability in AyeCode Ltd UsersWP.This issue affects UsersWP: from n/a through 1.2.3.9.

7. CVE-2022-0442 UsersWP < 1.2.3.1 - Subscriber+ User Avatar Override

   Published 2022-03-07

   Medium·CVSS 4.3 EPSS 0.65%

   The UsersWP WordPress plugin before 1.2.3.1 is missing access controls when updating a user avatar, and does not make sure file names for user avatars are unique, allowing a logged in user to overwrite another users avatar.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.