Skip to content
OpenAdvisories

Vendor

DeluxeThemes

11 known vulnerabilities.

Products

Userpro 7 Private Messages for UserPro 2 Media Manager for UserPro 2
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 7.5
    CVE-2025-68608

    WordPress Userpro plugin <= 5.1.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in DeluxeThemes Userpro userpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Userpro: from n/a through <= 5.1.9.

    DeluxeThemes Userpro
  • High 8.8
    CVE-2024-12821

    Media Manager for UserPro <= 3.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update

    The Media Manager for UserPro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the upm_upload_media() function in all versions up to, and including, 3.12.0. This…

    DeluxeThemes Media Manager for UserPro Web / CMS
  • High 7.1
    CVE-2025-22322

    WordPress Private Messages for UserPro plugin <= 4.10.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DeluxeThemes Private Messages for UserPro userpro-messaging allows Reflected XSS.This issue affects Private Messages for UserPro: from n/a through <= 4.10.0.

    DeluxeThemes Private Messages for UserPro
  • High 7.5
    CVE-2025-22311

    WordPress Private Messages for UserPro plugin <= 4.10.0 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in DeluxeThemes Private Messages for UserPro userpro-messaging.This issue affects Private Messages for UserPro: from n/a through <= 4.10.0.

    DeluxeThemes Private Messages for UserPro
  • High 7.1
    CVE-2024-56210

    WordPress UserPro plugin <= 5.1.9 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DeluxeThemes Userpro userpro allows Reflected XSS.This issue affects Userpro: from n/a through <= 5.1.9.

    DeluxeThemes Userpro
  • High 8.5
    CVE-2024-56212

    WordPress UserPro plugin <= 5.1.9 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DeluxeThemes Userpro userpro.This issue affects Userpro: from n/a through <= 5.1.9.

    DeluxeThemes Userpro
  • High 8.8
    CVE-2024-56211

    WordPress UserPro plugin <= 5.1.9 - Authenticated Arbitrary User Meta Update vulnerability

    Missing Authorization vulnerability in DeluxeThemes Userpro userpro.This issue affects Userpro: from n/a through <= 5.1.9.

    DeluxeThemes Userpro
  • High 8.3
    CVE-2024-56214

    WordPress UserPro plugin <= 5.1.9 - Local File Inclusion vulnerability

    Path Traversal: '.../...//' vulnerability in DeluxeThemes Userpro userpro allows Path Traversal.This issue affects Userpro: from n/a through <= 5.1.9.

    DeluxeThemes Userpro