What’s Vulnerable › Vulnerabilities

CVE-2018-16285

• Severity: medium (CVSS 6.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-09-06 · updated 2026-06-17
• Weakness: CWE-79

Description

The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userpro_shortcode_template action to wp-admin/admin-ajax.php.

Affected products

• UserPro - Community and User Profile WordPress Plugin: through 4.9.23

References

• https://risataim.blogspot.com/2018/09/xss-en-plugin-userpro-de-wordpress.html
• https://wpvulndb.com/vulnerabilities/9124
• https://risataim.blogspot.com/2018/09/xss-en-plugin-userpro-de-wordpress.html
• https://wpvulndb.com/vulnerabilities/9124

Get alerted when CVE-2018-16285 or the next vulnerability affects your stack