CVSS: 10.0EPSS: 8%CPEs: 1EXPL: 1CVE-2022-4049 – WP User <= 7.0 - Unauthenticated SQLi
https://notcve.org/view.php?id=CVE-2022-4049
09 Dec 2022 — The WP User WordPress plugin through 7.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users. El complemento WP User de WordPress hasta la versión 7.0 no sanitiza ni escapa adecuadamente un parámetro antes de usarlo en una declaración SQL, lo que genera una inyección SQL explotable por usuarios no autenticados. The WP User plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 7.0... • https://wpscan.com/vulnerability/9b0781e2-ad62-4308-bafc-d45b9a2472be • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-4519 – WP User <= 7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-4519
06 Dec 2022 — The WP User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. El c... • https://wordpress.org/plugins/wp-user/#description • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-25034 – WP User < 7.0 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-25034
31 Jan 2022 — The WP User WordPress plugin before 7.0 does not sanitise and escape some parameters in pages where the [wp_user] shortcode is used, leading to Reflected Cross-Site Scripting issues El plugin WP User de WordPress versiones anteriores a 7.0, no sanea ni escapa de algunos parámetros en las páginas donde es usado el shortcode [wp_user], conllevando a problemas de tipo Cross-Site Scripting Reflejado. The WP User WordPress plugin before 7.0 does not sanitise and escape some parameters in pages where the [wp_user... • https://wpscan.com/vulnerability/c4e50dd2-450f-413d-b15f-ece413e42157 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •