Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-17
Userpro - Cross-Site Request Forgery (CSRF) (CVE-2023-2447)
The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing or incorrect nonce validation on the 'export_users' function. This makes it possible for unauthenticated attackers to export the users to a csv file, granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Userpro
CVE-2023-2447
Risk Score
Threat Entry
Updated 2026-06-17
UserPro - Cross-Site Scripting (XSS) (CVE-2019-14470)
cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/success.php error_description parameter.
PLUGIN
UserPro
CVE-2019-14470
Risk Score
Threat Entry
Updated 2026-06-17
Userpro - Cross-Site Scripting (XSS) (CVE-2018-16285)
The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userpro_shortcode_template action to wp-admin/admin-ajax.php.
PLUGIN
Userpro
CVE-2018-16285
Risk Score
Threat Entry
Updated 2026-06-17
Userpro - Security Vulnerability (CVE-2017-16562)
The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentication and obtain administrative access via a "true" value for the up_auto_log parameter in the QUERY_STRING to the default URI.
PLUGIN
Userpro
CVE-2017-16562
Risk Score