vciy

CVEs we hold for User

Records whose assigning authority named User as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-86814UsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider EmailUnknown UsersWP
CVE-2026-86407User Registration & Membership < 5.2.8 - Unauthenticated User Data Disclosure via Membership Thank You PageUnknown User Registration & Membership
CVE-2026-86406User Registration & Membership < 5.2.8 - Subscriber+ Privilege Escalation via Membership PurchaseUnknown User Registration & Membership
CVE-2026-80072User Registration & Membership < 5.2.8 - Unauthenticated Open Redirect via Login Redirect ParametersUnknown User Registration & Membership
CVE-2026-80071User Registration & Membership < 5.2.8 - Author+ Privilege Escalation to AdministratorUnknown User Registration & Membership
CVE-2026-79996User Registration & Membership < 5.2.6 - Authenticated Privilege Escalation via Login SettingsUnknown User Registration & Membership
CVE-2026-79995User Registration & Membership < 5.2.5 - Subscriber+ Pending Email Change Cancellation via IDORUnknown User Registration & Membership
CVE-2026-76548Profile Builder < 4.0.1 - Unauthenticated Unpublished Content and Media Modification via Front-End Upload Auth BypassUnknown User Profile Builder
CVE-2026-76547Profile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/ExportUnknown User Profile Builder
CVE-2026-76546Profile Builder < 4.0.1 - Contributor+ Stored XSS via Format Date ShortcodeUnknown User Profile Builder
CVE-2026-19116WP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit FormUnknown User Frontend
CVE-2026-18035User Access Manager < 2.3.15 - Unauthenticated Restricted Content Disclosure via REST APIUnknown User Access Manager
CVE-2026-17563WP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated FormUnknown User Frontend
CVE-2026-16736User Registration & Membership < 5.2.6 - Unauthenticated Account Creation While Registration DisabledUnknown User Registration & Membership
CVE-2026-15368Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After RegistrationUnknown User Profile Builder
CVE-2026-14861User Verification <= 2.0.47 - Unauthenticated Arbitrary Account Lockout via IDORUnknown User Verification by PickPlugins
CVE-2026-14568WP User Frontend < 4.3.8 - Unauthenticated Author-less Attachment DeletionUnknown User Frontend: AI Powered Frontend Post Submission…
CVE-2026-14567WP User Frontend < 4.3.10 - Unauthenticated User Email and Phone Disclosure via User DirectoryUnknown User Frontend
CVE-2026-14558WP User Frontend < 4.3.10 - Editor+ PHP Object Injection via AI Form BuilderUnknown User Frontend
CVE-2026-13690UsersWP < 1.2.67 - Two-Factor Authentication BypassUnknown UsersWP
CVE-2026-11966User Registration & Membership < 5.2.3 - Unauthenticated Limited User Deletion via Stripe Subscription HandlerUnknown User Registration & Membership
CVE-2026-11965User Registration & Membership < 5.2.0 - Unauthenticated Paid Membership BypassUnknown User Registration & Membership
CVE-2026-11964User Registration & Membership < 5.2.2 - Unauthenticated PayPal Webhook Signature Verification Bypass Leading to…Unknown User Registration & Membership
CVE-2026-11963User Registration & Membership < 5.2.2 - Subscriber+ Cross-User Role and Membership Tier Modification via IDORUnknown User Registration & Membership
CVE-2026-11961User Registration & Membership < 5.2.3 - Unauthenticated Privilege Escalation via Unbound members_data Membership IDUnknown User Registration & Membership
CVE-2026-11570User Submitted Posts < 20260608 - Unauthenticated Stored XSS via Author NameUnknown User Submitted Posts
CVE-2025-66116WordPress Ultimate Member Widgets for Elementor plugin <= 2.3 - Sensitive Data Exposure vulnerabilityUserElements Ultimate Member Widgets for Elementor
CVE-2025-4187UserPro - Community and User Profile WordPress Plugin <= 5.1.10 - Unauthenticated Arbitrary File Readn/a UserPro - Community and User Profile WordPress Plugin
CVE-2025-31079WordPress Usermaven plugin <= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerabilityUsermaven
CVE-2025-2594User Registration & Membership < 4.1.3 - Authentication BypassUnknown User Registration & Membership
CVE-2025-2563User Registration & Membership < 4.1.2- Unauthenticated Privilege EscalationUnknown User Registration & Membership
CVE-2025-2112user-xiangpeng yaoqishan MediaInfoService.java getMediaLisByFilter sql injectionuser-xiangpeng yaoqishan
CVE-2025-15030User Profile Builder < 3.15.2 - Unauthenticated Arbitrary Password ResetUnknown User Profile Builder
CVE-2025-14540Userback <= 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Plugin's Configuration ExposureUserback
CVE-2025-13471User Activity Log <= 2.2 - Unauthenticated Limited Arbitrary Option UpdateUnknown User Activity Log
CVE-2025-12778Ultimate Member Widgets for Elementor <= 2.3 - Missing Authorization to Unauthenticated Information Exposureuserelements Ultimate Member Widgets for Elementor –…
CVE-2024-9520UserPlus <= 2.0 - Missing Authorization via Multiple FunctionsUserPlus
CVE-2024-9519UserPlus <= 2.0 - Authenticated (Editor+) Registration Form Update to Privilege EscalationUserPlus
CVE-2024-9518UserPlus <= 2.0 - Unauthenticated Privilege EscalationUserPlus
CVE-2024-6708Profile Builder <= 3.12.0 - Admin+ Stored Cross Site ScriptingUnknown User Profile Builder
CVE-2024-6695profile-builder <= 3.11.8 - Unauthenticated Privilege EscalationUnknown User Profile Builder
CVE-2024-6477UsersWP < 1.2.12 - Users Information DisclosureUnknown UsersWP
CVE-2024-6366User Profile Builder < 3.11.8 - Unauthenticated Media UploadUnknown User Profile Builder
CVE-2024-52442WordPress UserPlus plugin <= 2.0 - Privilege Escalation vulnerabilityUserPlus
CVE-2024-5002User Submitted Posts < 20240516 - Admin+ Stored XSSUnknown User Submitted Posts
CVE-2024-33575WordPress User Meta plugin <= 3.0 - Sensitive Data Exposure vulnerabilityUser Meta
CVE-2024-13222User Messages <= 1.2.4 - Reflected XSSUnknown User Messages
CVE-2024-1290Formidable Registration < 2.12 - Contributor+ Arbitrary User Password Reset To Account TakeoverUnknown User Registration
CVE-2024-0970User Activity Tracking and Log < 4.1.4 - IP SpoofingUnknown User Activity Tracking and Log
CVE-2024-0701UserPro <= 5.1.6 - Disabled Membership Registration Bypassn/a UserPro - Community and User Profile WordPress Plugin
CVE-2023-6009UserPro <= 5.1.4 - Authenticated (Subscriber+) Privilege Escalationn/a UserPro - Community and User Profile WordPress Plugin
CVE-2023-6008UserPro <= 5.1.1 - Cross-Site Request Forgery via multiple functionsn/a UserPro - Community and User Profile WordPress Plugin
CVE-2023-6007UserPro <= 5.1.1 - Missing Authorization via multiple functionsn/a UserPro - Community and User Profile WordPress Plugin
CVE-2023-5228User Registration < 3.0.4.2 - Admin+ Stored XSSUnknown User Registration
CVE-2023-5167User Activity Log Pro < 2.3.4 - Unauthenticated Stored Cross-Site Scripting via User AgentUnknown user-activity-log-pro
CVE-2023-5133User Activity Log Pro < 2.3.4 - IP SpoofingUnknown user-activity-log-pro
CVE-2023-4798User Avatar - Reloaded < 1.2.2 - Contributor+ Stored XSSUnknown User Avatar
CVE-2023-47553WordPress UserHeat Plugin Plugin <= 1.1.6 is vulnerable to Cross Site Request Forgery (CSRF)User Local Inc UserHeat Plugin
CVE-2023-46153WordPress User Feedback Plugin <= 1.0.9 is vulnerable to Cross Site Scripting (XSS)UserFeedback Team User Feedback
CVE-2023-4279User Activity Log < 1.6.7 - IP SpoofingUnknown User Activity Log
CVE-2023-4269User Activity Log < 1.6.6 - Subscriber+ Log ExportUnknown User Activity Log
CVE-2023-4150User Activity Tracking and Log < 4.0.9 - License Update/Deactivation via CSRFUnknown User Activity Tracking and Log
CVE-2023-39308WordPress User Feedback Plugin <= 1.0.7 is vulnerable to Cross Site Scripting (XSS)UserFeedback Team User Feedback
CVE-2023-3435User Activity Log < 1.6.5 - Unauthenticated SQLiUnknown User Activity Log
CVE-2023-2761User Activity Log < 1.6.3 - Admin+ SQL InjectionUnknown User Activity Log
CVE-2023-2497UserPro <= 5.1.0 - Cross-Site Request Forgery to PHP Object Injectionn/a UserPro - Community and User Profile WordPress Plugin
CVE-2023-2449UserPro <= 5.1.1 - Insecure Password Reset Mechanismn/a UserPro - Community and User Profile WordPress Plugin
CVE-2023-2448UserPro <= 5.1.4 - Missing Authorization to Arbitrary Shortcode Execution via userpro_shortcode_templaten/a UserPro - Community and User Profile WordPress Plugin
CVE-2023-2447UserPro <= 5.1.1 - Cross-Site Request Forgery to Sensitive Information Exposuren/a UserPro - Community and User Profile WordPress Plugin
CVE-2023-2446UserPro <= 5.1.1 - Sensitive Information Disclosure via Shortcoden/a UserPro - Community and User Profile WordPress Plugin
CVE-2023-2440UserPro <= 5.1.1 - Cross-Site Request Forgery to Privilege Escalationn/a UserPro - Community and User Profile WordPress Plugin
CVE-2023-2439no title heldn/a UserPro - Community and User Profile WordPress Plugin
CVE-2023-2438UserPro <= 5.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via userpro_save_userdatan/a UserPro - Community and User Profile WordPress Plugin
CVE-2023-2437UserPro <= 5.1.1 - Authentication Bypass to Administratorn/a UserPro - Community and User Profile WordPress Plugin
CVE-2023-23712WordPress User Meta Manager Plugin <= 3.4.9 is vulnerable to Cross Site Request Forgery (CSRF)User Meta Manager
CVE-2023-0824UserPlus <= 2.0 - Stored XSS via CSRFUnknown User registration & user profile
CVE-2023-0820User Role by BestWebSoft < 1.6.7 - Privilege Escalation via CSRFUnknown User Role by BestWebSoft
CVE-2022-47607WordPress Usersnap Plugin <= 4.16 is vulnerable to Cross Site Scripting (XSS)Usersnap
CVE-2022-4693User Verification < 1.0.94 - Authentication BypassUnknown User Verification
CVE-2022-4550User Activity <= 1.0.1 - IP SpoofingUnknown User Activity
CVE-2022-4060User Post Gallery <= 2.19 - Unauthenticated RCEUnknown User Post Gallery
CVE-2022-3912User Registration < 2.2.4.1 - Subscriber+ Arbitrary File UploadUnknown User Registration
CVE-2022-28229no title heldn/a userver
CVE-2022-1601User Access Manager < 2.2.18 - IP SpoofingUnknown User Access Manager
CVE-2022-0779User Meta < 2.4.4 - Subscriber+ Local File Enumeration via Path TraversalUnknown User Meta – User Profile Builder and User…
CVE-2022-0769Users Ultra <= 3.1.0 - Unauthenticated SQL InjectionUnknown Users Ultra Membership, Users Community and Member…
CVE-2022-0442UsersWP < 1.2.3.1 - Subscriber+ User Avatar OverrideUnknown UsersWP – User Registration & User Profile
CVE-2022-0376User Meta < 2.4.3 - Admin+ Stored Cross-Site ScriptingUnknown User Meta – User Profile Builder and User…
CVE-2022-0232User Registration, Login & Landing Pages – LeadMagic <= 1.2.7 Admin+ Stored Cross-Site ScriptingUser Registration, Login & Landing Pages – LeadMagic
CVE-2021-38325User Activation Email <= 1.3.0 Reflected Cross-Site ScriptingUser Activation Email
CVE-2021-25994Userfrosting - Host-Header Injection Leads to Account Takeoveruserfrosting
CVE-2021-24955ProfilePress < 3.2.3 - Reflected Cross-Site ScriptingUnknown User Registration, Login Form, User Profile &…
CVE-2021-24954ProfilePress < 3.2.3 - Reflected Cross-Site ScriptingUnknown User Registration, Login Form, User Profile &…
CVE-2021-24859User Meta Shortcodes <= 0.5 - Contributor+ Unauthorized Arbitrary User Metadata AccessUnknown User meta shortcodes
CVE-2021-24654User Registration < 2.0.2 - Low Privilege Stored Cross-Site ScriptingUnknown User Registration – Custom Registration Form, Login…
CVE-2021-24527Profile Builder < 3.4.9 - Admin Access via Password ResetUnknown User Registration & User Profile – Profile Builder
CVE-2021-24522ProfilePress < 3.1.11 - Unauthenticated Cross-Site Scripting (XSS) in tabbed login/register widgetUnknown User Registration, User Profile, Login & Membership…
CVE-2021-24473User Profile Picture < 2.6.0 - Arbitrary User Picture Change/Deletion via IDORUnknown User Profile Picture
CVE-2021-24450ProfilePress < 3.1.8 - Authenticated Stored XSSUnknown User Registration, User Profiles, Login &…
CVE-2021-24448Profile Builder < 3.4.8 - Authenticated Stored XSSUnknown User Registration & User Profile – Profile Builder
CVE-2021-24170User Profile Picture < 2.5.0 - Sensitive Information DisclosureUnknown User Profile Picture
CVE-2018-25350userSpice 4.3.24 Username Enumeration via existingUsernameCheck.phpuserSpice
CVE-2018-25349userSpice 4.3.24 Cross-Site Scripting via X-Forwarded-For HeaderuserSpice
CVE-2015-2079no title heldUsermin

104 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.