CVSS: 9.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-53810 – WordPress Simple User Registration plugin <= 5.5 - Broken Access Control on User Deletion vulnerability
https://notcve.org/view.php?id=CVE-2024-53810
02 Dec 2024 — Missing Authorization vulnerability in Najeeb Ahmad Simple User Registration allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Simple User Registration: from n/a through 5.5. The Simple User Registration plugin for WordPress is vulnerable to unauthorized access to the user deletion feature due to a missing capability check in all versions up to, and including, 5.5. This makes it possible for unauthenticated attackers to delete arbitrary users. • https://patchstack.com/database/wordpress/plugin/wp-registration/vulnerability/wordpress-simple-user-registration-plugin-5-5-broken-access-control-on-user-deletion-vulnerability?_s_id=cve • CWE-862: Missing Authorization •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-49604 – WordPress Simple User Registration plugin <= 5.5 - Account Takeover vulnerability
https://notcve.org/view.php?id=CVE-2024-49604
17 Oct 2024 — Authentication Bypass Using an Alternate Path or Channel vulnerability in Najeeb Ahmad Simple User Registration allows Authentication Bypass.This issue affects Simple User Registration: from n/a through 5.5. The Simple User Registration plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on a function in all versions up to, and including, 6.1. This makes it possible for unauthenticated attackers to takeover other users accounts and elevate their privileges • https://patchstack.com/database/vulnerability/wp-registration/wordpress-simple-user-registration-plugin-5-5-account-takeover-vulnerability?_s_id=cve • CWE-288: Authentication Bypass Using an Alternate Path or Channel CWE-862: Missing Authorization •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2023-27609 – WordPress WP Roles at Registration plugin <= 0.23 - Cross Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2023-27609
14 Apr 2023 — Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in NetTantra WP Roles at Registration allows Stored XSS.This issue affects WP Roles at Registration: from n/a through 0.23. The WP Roles at Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 0.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrato... • https://patchstack.com/database/vulnerability/wp-roles-at-registration/wordpress-wp-roles-at-registration-plugin-0-23-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •