parorrey JSON API User vulnerabilities

Latest parorrey JSON API User CVEs

Newest publication first

1. CVE-2026-9626 JSON API User <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter

   Published 2026-07-03

   Medium·CVSS 6.4 EPSS 0.38%

   The JSON API User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter of the post_comment API endpoint in versions up to, and including, 4.1.0 This is due to insufficient input sanitization in the post_comment() function, which passes the...

2. CVE-2024-6624 JSON API User <= 3.9.3 - Unauthenticated Privilege Escalation

   Published 2024-07-11

   Critical·CVSS 9.8 EPSS 2.9%

   The JSON API User plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.9.3. This is due to improper controls on custom user meta fields. This makes it possible for unauthenticated attackers to register as administrators on the site. T...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.