Extension WordPress
Vulnérabilités User Meta – User Profile Builder and User management plugin
Cette page rassemble les failles publiées pour User Meta – User Profile Builder and User management plugin, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de User Meta – User Profile Builder and User management plugin
7 fiches
User Meta – User Profile Builder and User management plugin <= 3.1.2 – Authenticated (Subscriber+) Arbitrary File Deletion
The User Meta – User Profile Builder and User management plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the postInsertUserProcess function in all versions up to, and including, 3.1.2.…
*-3.1.2
Non indiqué
10/09/2025
User Meta <= 3.1.2 – Reflected Cross-Site Scripting
The User Meta plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…
*-3.1.2
Non indiqué
22/05/2025
User Meta – User Profile Builder and User management plugin <= 3.1.1 – Insecure Direct Object Reference to Sensitive Information Exposure
The User Meta – User Profile Builder and User management plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.1 via the getUser() due to missing validation on a…
*-3.1.1
3.1.2
08/11/2024
User Meta <= 3.0 – Unauthenticated Sensitive Information Exposure
The User Meta – User Profile Builder and User management plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0 via the /views/debug.php file. This makes it possible for unauthenticated…
*-3.0
3.1
25/04/2024
User Meta – User Profile Builder and User management plugin <= 2.4.3 – Path Traversal
The User Meta WordPress plugin before 2.4.4 does not validate the filepath parameter of its um_show_uploaded_file AJAX action, which could allow low privileged users such as subscriber to enumerate the local files on the web server via path…
[*, 2.4.4)
2.4.4
16/05/2022
User Meta <= 2.4.2 – Authenticated (Admin+) Cross-Site Scripting
The User Meta WordPress plugin before 2.4.3 does not sanitise and escape the Form Name, as well as Shared Field Labels before outputting them in the admin dashboard when editing a form, which could allow high privilege users…
*-2.4.2
2.4.3
09/05/2022
User Meta – User Profile Builder and User management plugin 1.1.1 – Arbitrary File Upload
The User Meta plugin for wordPress is vulnerable to Arbitrary File Uploads in versions up to, and including 1.1.1, due to insufficient file type validation in the user-meta/framework/helper/uploader.php file. This makes it possible for attackers to upload malicious…
1.1.1
1.1.2
01/08/2014
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.