Skip to content
OpenAdvisories

Product · vanquish

WordPress User Extra Fields

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2024-11150

    WordPress User Extra Fields <= 16.6 - Unauthenticated Arbitrary File Deletion

    The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_tmp_uploaded_file() function in all versions up to, and including, 16.6. This makes it possible for unauthenti…

    vanquish WordPress User Extra Fields Web / CMS
  • Critical 9.8
    CVE-2024-10801

    WordPress User Extra Fields <= 16.5 - Unauthenticated Arbitrary File Upload

    The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_manage_file_chunk_upload() function in all versions up to, and including, 16.5. This makes it possible for unauthentic…

    vanquish WordPress User Extra Fields Web / CMS