User registration & user profile – UserPlus

User registration & user profile – UserPlus has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2024; none of them are fixed as of September 2026. Their average CVSS score is 7.8, and the most serious one scores 9.8 out of 10. Severity breakdown: 2 critical and 1 high. 2024 was the busiest year with 4 disclosures.

The most common weakness is Missing Authorization, behind 2 of the records (40%). Other recurring categories include Cross-Site Request Forgery (CSRF), Improper Privilege Management.

None of the 5 issues recorded for User registration & user profile – UserPlus have a published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2023.

3 independent researchers contributed these findings, most of them (3) reported by István Márton.

Strategic Overview

Avg CVSSHigh

7.8/ 10

Patch Coverage0%

Open

Fixed

Get automatic notifications for all User registration & user profile – UserPlus vulnerabilities before they are exploited.

Most severe open issueCVSS 9.8CVE-2024-52442

UserPlus <= 2.0 - Privilege Escalation

Read the full analysis

Vulnerability Records

5 records


2024-11-18 00:00	UserPlus <= 2.0 - Privilege Escalation User registration & user profile <= 2.0	`CVE-2024-52442`	9.8 Critical	João Pedro Soares de Alcântara	No
2024-10-09 00:00	UserPlus <= 2.0 - Authenticated (Editor+) Registration Form Update to Privilege Escalation User registration & user profile <= 2.0	`CVE-2024-9519`	7.2 High	István Márton	No
2024-10-09 00:00	UserPlus <= 2.0 - Unauthenticated Privilege Escalation User registration & user profile <= 2.0	`CVE-2024-9518`	9.8 Critical	István Márton	No
2024-10-09 00:00	UserPlus <= 2.0 - Missing Authorization via Multiple Functions User registration & user profile <= 2.0	`CVE-2024-9520`	6.3 Medium	István Márton	No
2023-04-12 00:00	UserPlus <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting User registration & user profile <= 2.0	`CVE-2023-0824`	6.1 Medium	Shreya Pohekar	No

Showing 1–5 of 5 reports