Advisories · Technology

UserPro - Community and User Profile WordPress Plugin.

Every CVE that names UserPro - Community and User Profile WordPress Plugin among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-4187 CVE record

CVSS 5.9 Medium

UserPro - Community and User Profile WordPress Plugin <= 5.1.10 - Unauthenticated Arbitrary File Read
- UserPro - Community and User Profile WordPress Plugin
- Path traversal
Not analysed yet 14 Jun 2025
CVE-2024-0701 CVE record

CVSS 5.3 Medium

UserPro <= 5.1.6 - Disabled Membership Registration Bypass
- UserPro - Community and User Profile WordPress Plugin
- CWE-602
Not analysed yet 5 Feb 2024
CVE-2023-2439 CVE record

CVSS 6.4 Medium

The UserPro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userpro' shortcode in versions up to, and including, 5.1.5 due to insufficient input sanitization and output esc…
- UserPro - Community and User Profile WordPress Plugin
Not analysed yet 31 Jan 2024
CVE-2023-2497 CVE record

CVSS 8.8 High

UserPro <= 5.1.0 - Cross-Site Request Forgery to PHP Object Injection
- UserPro - Community and User Profile WordPress Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 22 Nov 2023
CVE-2023-6008 CVE record

CVSS 6.3 Medium

UserPro <= 5.1.1 - Cross-Site Request Forgery via multiple functions
- UserPro - Community and User Profile WordPress Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 22 Nov 2023
CVE-2023-6009 CVE record

CVSS 8.8 High

UserPro <= 5.1.4 - Authenticated (Subscriber+) Privilege Escalation
- UserPro - Community and User Profile WordPress Plugin
- Privilege escalation
Not analysed yet 22 Nov 2023
CVE-2023-2449 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

UserPro <= 5.1.1 - Insecure Password Reset Mechanism
- UserPro - Community and User Profile WordPress Plugin
- CWE-620
Not analysed yet 22 Nov 2023
CVE-2023-2437 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

UserPro <= 5.1.1 - Authentication Bypass to Administrator
- UserPro - Community and User Profile WordPress Plugin
- Authentication bypass
Not analysed yet 22 Nov 2023
CVE-2023-2438 CVE record

CVSS 6.1 Medium

UserPro <= 5.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via userpro_save_userdata
- UserPro - Community and User Profile WordPress Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 22 Nov 2023
CVE-2023-2448 CVE record

CVSS 6.5 Medium

UserPro <= 5.1.4 - Missing Authorization to Arbitrary Shortcode Execution via userpro_shortcode_template
- UserPro - Community and User Profile WordPress Plugin
- Broken access control
Not analysed yet 22 Nov 2023
CVE-2023-2440 CVE record

CVSS 8.8 High

UserPro <= 5.1.1 - Cross-Site Request Forgery to Privilege Escalation
- UserPro - Community and User Profile WordPress Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 22 Nov 2023
CVE-2023-6007 CVE record

CVSS 7.3 High

UserPro <= 5.1.1 - Missing Authorization via multiple functions
- UserPro - Community and User Profile WordPress Plugin
- Broken access control
Not analysed yet 22 Nov 2023
CVE-2023-2446 CVE record

CVSS 6.5 Medium

UserPro <= 5.1.1 - Sensitive Information Disclosure via Shortcode
- UserPro - Community and User Profile WordPress Plugin
- Information disclosure
Not analysed yet 22 Nov 2023
CVE-2023-2447 CVE record

CVSS 6.1 Medium

UserPro <= 5.1.1 - Cross-Site Request Forgery to Sensitive Information Exposure
- UserPro - Community and User Profile WordPress Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 22 Nov 2023