User Extra Fields

2 CVEs product

Monthly

Sort: Newest CVSS Score EPSS Score Oldest

CVE-2024-11150 Nov 13, 05:15 CRITICAL Act Now

The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_tmp_uploaded_file() function in all versions up. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

PHP WordPress RCE Path Traversal User Extra Fields +1

NVD

CVSS 3.1

9.8

EPSS

1.3%

CVE-2024-10800 Nov 13, 05:15 HIGH This Week

The WordPress User Extra Fields plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the ajax_save_fields() function in all versions up to, and including,. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

WordPress Authentication Bypass Privilege Escalation User Extra Fields Vanquish

NVD

CVSS 3.1

8.8

EPSS

0.8%

CVE-2024-11150

EPSS 1% CVSS 9.8

CRITICAL Act Now

PHP WordPress RCE +3

NVD

CVE-2024-10800

EPSS 1% CVSS 8.8

HIGH This Week

WordPress Authentication Bypass Privilege Escalation +2

NVD