User Meta Vulnerabilities

The User Meta – User Profile Builder and User management plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the postInsertUserProcess function in all versions up to, and including, 3.1.2. This makes it possible for authenticated attackers, with Subscriber-le...

CVSS:

8

Affected:

up to 3.1.2

Fix:

No patched version reported

Disclosed:

Sep 10, 2025

CVE-2025-9693 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Khaled User Meta allows Reflected XSS. This issue affects User Meta: from n/a through 3.1.2.

Affected:

up to 3.1.2

Fix:

No patched version reported

Disclosed:

May 23, 2025

CVE-2025-47611 on NVD →

The User Meta plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick...

CVSS:

6.1

Affected:

up to 3.1.2

Fix:

No patched version reported

Disclosed:

May 22, 2025

CVE-2025-47611 on NVD →

[en] The User Meta – User Profile Builder and User management plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1 via the getUser() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor...

Affected:

up to 3.1

Fix:

No patched version reported

Disclosed:

Nov 9, 2024

CVE-2024-9262 on NVD →

The User Meta – User Profile Builder and User management plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.1 via the getUser() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-le...

CVSS:

6.5

Affected:

up to 3.1.1

Fixed in:

3.1.2

Disclosed:

Nov 8, 2024

CVE-2024-9262 on NVD →

[en] Exposure of Sensitive Information to an Unauthorized Actor vulnerability in User Meta user-meta.This issue affects User Meta: from n/a through 3.0.

Affected:

up to 3.1

Fixed in:

3.1

Disclosed:

Apr 29, 2024

CVE-2024-33575 on NVD →

The User Meta – User Profile Builder and User management plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0 via the /views/debug.php file. This makes it possible for unauthenticated attackers, with to extract sensitive configuration data.

CVSS:

5.3

Affected:

up to 3.0

Fixed in:

3.1

Disclosed:

Apr 25, 2024

CVE-2024-33575 on NVD →

[en] The User Meta WordPress plugin before 2.4.4 does not validate the filepath parameter of its um_show_uploaded_file AJAX action, which could allow low privileged users such as subscriber to enumerate the local files on the web server via path traversal payloads

Affected:

up to 2.4.4

Fixed in:

2.4.4

Disclosed:

Jun 6, 2022

CVE-2022-0779 on NVD →

[en] The User Meta WordPress plugin before 2.4.3 does not sanitise and escape the Form Name, as well as Shared Field Labels before outputting them in the admin dashboard when editing a form, which could allow high privilege users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Affected:

up to 2.4.3

Fixed in:

2.4.3

Disclosed:

May 30, 2022

CVE-2022-0376 on NVD →

The User Meta WordPress plugin before 2.4.4 does not validate the filepath parameter of its um_show_uploaded_file AJAX action, which could allow low privileged users such as subscriber to enumerate the local files on the web server via path traversal payloads

CVSS:

4.3

Affected:

up to 2.4.4

Fixed in:

2.4.4

Disclosed:

May 16, 2022

CVE-2022-0779 on NVD →

The User Meta WordPress plugin before 2.4.3 does not sanitise and escape the Form Name, as well as Shared Field Labels before outputting them in the admin dashboard when editing a form, which could allow high privilege users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

CVSS:

5.5

Affected:

up to 2.4.2

Fixed in:

2.4.3

Disclosed:

May 9, 2022

CVE-2022-0376 on NVD →

The User Meta plugin for wordPress is vulnerable to Arbitrary File Uploads in versions up to, and including 1.1.1, due to insufficient file type validation in the user-meta/framework/helper/uploader.php file. This makes it possible for attackers to upload malicious files and achieve remote code execution.

CVSS:

6.5

Affected:

1.1.1 – 1.1.1

Fixed in:

1.1.2

Disclosed:

Aug 1, 2014

The User Meta plugin for wordPress is vulnerable to Arbitrary File Uploads in versions up to, and including 1.1.1, due to insufficient file type validation in the user-meta/framework/helper/uploader.php file. This makes it possible for attackers to upload malicious files and achieve remote code execution.

Affected:

up to 1.1.2

Fixed in:

1.1.2

Disclosed:

Aug 1, 2014

User Meta plugin is prone to an arbitrary file upload vulnerability. Restricted access to this script is not properly realized. In that way an attacker can to upload files containing malicious PHP code and run it in the context of the web server process. Other attacks are also possible. Update the plugin.

Affected:

up to 1.1.2

Fixed in:

1.1.2

Disclosed:

Jun 11, 2012

The User Meta – User Profile Builder and User management plugin WordPress plugin was affected by an Arbitrary File Upload security vulnerability.

Affected:

up to 1.1.2

Fixed in:

1.1.2