CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-2546 – WP User Switch <= 1.0.2 - Authenticated (Subscriber+) Authentication Bypass via Cookie
https://notcve.org/view.php?id=CVE-2023-2546
04 Jun 2023 — The WP User Switch plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0.2. This is due to incorrect authentication checking in the 'wpus_allow_user_to_admin_bar_menu' function with the 'wpus_who_switch' cookie value. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to log in as any existing user on the site, such as an administrator, if they have access to the username. • https://lana.codes/lanavdb/0cfdc5fa-d219-46bb-b8cc-693ac28a9e92 • CWE-288: Authentication Bypass Using an Alternate Path or Channel •
CVSS: 10.0EPSS: 8%CPEs: 1EXPL: 1CVE-2022-4049 – WP User <= 7.0 - Unauthenticated SQLi
https://notcve.org/view.php?id=CVE-2022-4049
09 Dec 2022 — The WP User WordPress plugin through 7.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users. El complemento WP User de WordPress hasta la versión 7.0 no sanitiza ni escapa adecuadamente un parámetro antes de usarlo en una declaración SQL, lo que genera una inyección SQL explotable por usuarios no autenticados. The WP User plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 7.0... • https://wpscan.com/vulnerability/9b0781e2-ad62-4308-bafc-d45b9a2472be • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 2CVE-2022-3848 – WP User Merger < 1.5.3 - Admin+ SQLi via wpsu_user_id
https://notcve.org/view.php?id=CVE-2022-3848
07 Nov 2022 — The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin El complemento WP User Merger de WordPress anterior a 1.5.3 no sanitiza ni escapa adecuadamente un parámetro antes de usarlo en una declaración SQL, lo que lleva a una inyección de SQL explotable por usuarios con un rol tan bajo como administrador. The WP User Merger plugin for WordPress is vulnerabl... • https://bulletin.iese.de/post/wp-user-merger_1-5-1_2 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 2CVE-2022-3849 – WP User Merger < 1.5.3 - Admin+ SQLi via user_id
https://notcve.org/view.php?id=CVE-2022-3849
07 Nov 2022 — The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin El complemento WP User Merger de WordPress anterior a 1.5.3 no sanitiza ni escapa adecuadamente un parámetro antes de usarlo en una declaración SQL, lo que lleva a una inyección de SQL explotable por usuarios con un rol tan bajo como administrador. The WP User Merger plugin for WordPress is vulnerabl... • https://bulletin.iese.de/post/wp-user-merger_1-5-1_3 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 2CVE-2022-3865 – WP User Merger < 1.5.3 - Admin+ SQLi via ID
https://notcve.org/view.php?id=CVE-2022-3865
07 Nov 2022 — The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin El complemento WP User Merger de WordPress anterior a 1.5.3 no sanitiza ni escapa adecuadamente un parámetro antes de usarlo en una declaración SQL, lo que lleva a una inyección de SQL explotable por usuarios con un rol tan bajo como administrador. The WP User Merger plugin for WordPress is vulnerabl... • https://bulletin.iese.de/post/wp-user-merger_1-5-1_1 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-25034 – WP User < 7.0 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-25034
31 Jan 2022 — The WP User WordPress plugin before 7.0 does not sanitise and escape some parameters in pages where the [wp_user] shortcode is used, leading to Reflected Cross-Site Scripting issues El plugin WP User de WordPress versiones anteriores a 7.0, no sanea ni escapa de algunos parámetros en las páginas donde es usado el shortcode [wp_user], conllevando a problemas de tipo Cross-Site Scripting Reflejado. The WP User WordPress plugin before 7.0 does not sanitise and escape some parameters in pages where the [wp_user... • https://wpscan.com/vulnerability/c4e50dd2-450f-413d-b15f-ece413e42157 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •