What’s Vulnerable › Products
UserPro - Community and User Profile WordPress Plugin vulnerabilities
23 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.
Check whether your UserPro - Community and User Profile WordPress Plugin version is affected
Latest UserPro - Community and User Profile WordPress Plugin vulnerabilities
- CVE-2025-53444 — WordPress Userpro plugin < 5.1.11 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- CVE-2025-68608 — WordPress Userpro plugin <= 5.1.9 - Broken Access Control vulnerability (CVSS 7.5)
- CVE-2025-4187 — UserPro - Community and User Profile WordPress Plugin <= 5.1.10 - Unauthenticated Arbitrary File Read (CVSS 5.9)
- CVE-2024-56210 — WordPress UserPro plugin <= 5.1.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2024-56214 — WordPress UserPro plugin <= 5.1.9 - Local File Inclusion vulnerability (CVSS 8.3)
- CVE-2024-56212 — WordPress UserPro plugin <= 5.1.9 - SQL Injection vulnerability (CVSS 8.5)
- CVE-2024-56211 — WordPress UserPro plugin <= 5.1.9 - Authenticated Arbitrary User Meta Update vulnerability (CVSS 8.8)
- CVE-2024-35700 — WordPress UserPro plugin <= 5.1.8 - Unauthenticated Account Takeover vulnerability (CVSS 9.8)
- CVE-2024-0701 — UserPro <= 5.1.6 - Disabled Membership Registration Bypass (CVSS 5.3)
- CVE-2023-2439 — (CVSS 5.4)
- CVE-2023-6009 — UserPro <= 5.1.4 - Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8)
- CVE-2023-6008 — UserPro <= 5.1.1 - Cross-Site Request Forgery via multiple functions (CVSS 4.3)
- CVE-2023-6007 — UserPro <= 5.1.1 - Missing Authorization via multiple functions (CVSS 6.5)
- CVE-2023-2497 — UserPro <= 5.1.0 - Cross-Site Request Forgery to PHP Object Injection (CVSS 8.8)
- CVE-2023-2449 — UserPro <= 5.1.1 - Insecure Password Reset Mechanism (CVSS 9.8)
- CVE-2023-2448 — UserPro <= 5.1.4 - Missing Authorization to Arbitrary Shortcode Execution via userpro_shortcode_template (CVSS 5.3)
- CVE-2023-2440 — UserPro <= 5.1.1 - Cross-Site Request Forgery to Privilege Escalation (CVSS 8.8)
- CVE-2023-2438 — UserPro <= 5.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via userpro_save_userdata (CVSS 6.1)
- CVE-2023-2437 — UserPro <= 5.1.1 - Authentication Bypass to Administrator (CVSS 8.1)
- CVE-2023-2447 — UserPro <= 5.1.1 - Cross-Site Request Forgery to Sensitive Information Exposure (CVSS 6.1)
- CVE-2023-2446 — UserPro <= 5.1.1 - Sensitive Information Disclosure via Shortcode (CVSS 6.5)
- CVE-2018-16285 — (CVSS 6.1)
- CVE-2017-16562 — (CVSS 9.8)