Extension WordPress
Vulnérabilités WordPress User Extra Fields
Cette page rassemble les failles publiées pour WordPress User Extra Fields, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de WordPress User Extra Fields
8 fiches
User Extra Fields <= 16.8 – Unauthenticated Stored Cross-Site Scripting
The User Extra Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 16.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary…
*-16.8
16.9
09/02/2026
User Extra Fields <= 17.0 – Unauthenticated Arbitrary File Deletion
The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and including, 17.0. This makes it possible for unauthenticated attackers to delete arbitrary…
*-17.0
17.1
05/02/2026
User Extra Fields <= 17.0 – Authenticated (Subscriber+) Arbitrary File Deletion
The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and including, 17.0. This makes it possible for authenticated attackers, with Subscriber-level access…
*-17.0
Non indiqué
05/02/2026
User Extra Fields <= 16.8 – Missing Authorization
The WordPress User Extra Fields plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 16.8. This makes it possible for unauthenticated attackers to…
*-16.8
16.9
15/12/2025
WordPress User Extra Fields <= 16.7 – Authenticated (Subscriber+) Arbitrary File Deletion via save_fields Function
The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the save_fields() function in all versions up to, and including, 16.7. This makes it possible for authenticated…
*-16.7
16.8
30/10/2025
WordPress User Extra Fields <= 16.6 – Unauthenticated Arbitrary File Deletion
The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_tmp_uploaded_file() function in all versions up to, and including, 16.6. This makes it possible for unauthenticated…
*-16.6
16.7
12/11/2024
WordPress User Extra Fields <= 16.6 – Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
The WordPress User Extra Fields plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the ajax_save_fields() function in all versions up to, and including, 16.6. This makes it possible for authenticated attackers,…
*-16.6
16.7
12/11/2024
WordPress User Extra Fields <= 16.5 – Unauthenticated Arbitrary File Upload
The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_manage_file_chunk_upload() function in all versions up to, and including, 16.5. This makes it possible for unauthenticated…
*-16.5
16.6
08/11/2024
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.