WordPress plugin · users-ultra
Is Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin safe?
Closed. Replace it.
wordpress.org closed it on Mar 14, 2022 (security issue), so it gets no more security fixes, and 7 flaws are on record. If your site runs it, move to a maintained alternative.
- Flaws on record
- 7
- High or critical
- 5
- Exploited
- none
Every recorded flaw
- Apr 25, 2022Users Ultra: Fails to properly sanitize and escape the data_target parameter before it is being interpolated in an SQL statement and then executed via the rating_vote AJAX action (available to both unauthenticated and auCVE-2022-0769 · affects up to 3.1.0 · reported by WPScan8.3% oddsCritical 9.8
- Sep 20, 2019The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload.CVE-2015-9402 · fixed in 1.5.59 · reported by MITRE2.0% oddsHigh 8.8
- Sep 20, 2019The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action.CVE-2015-9395 · fixed in 1.5.64 · reported by MITRE1.7% oddsHigh 8.8
- Sep 20, 2019The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php.CVE-2015-9394 · fixed in 1.5.63 · reported by MITREHigh 8.8
- Sep 20, 2019The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter.CVE-2015-9393 · fixed in 1.5.63 · reported by MITREMedium 5.4
- Sep 20, 2019The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter.CVE-2015-9392 · fixed in 1.5.63 · reported by MITRE1.2% oddsMedium 5.4
- Jun 9, 2015Multiple SQL injection vulnerabilities in the ratings module in the Users Ultra plugin before 1.5.16 for WordPress allow remote attackers to execute arbitrary SCVE-2015-4109 · fixed in 1.5.16 · reported by MITRE2.3% oddsHigh 7.5
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.