CVE-2018-16285

NONE EPSS 67.9%

Published Sep 6, 20187y ago · Modified Jun 17, 20262w ago

Published Sep 6, 2018 7y ago

Last Modified Jun 17, 2026 2w ago

Description

The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userpro_shortcode_template action to wp-admin/admin-ajax.php.

Threat Intelligence

EPSS Exploit Probability

67.9% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

Vendor	Product	Version	Range
userproplugin	userpro	*	≤4.9.23

References 2

risataim.blogspot.com https://risataim.blogspot.com/2018/09/xss-en-plugin-userpro-de-wordpress.html

ExploitTechnical DescriptionThird Party Advisory
wpvulndb.com https://wpvulndb.com/vulnerabilities/9124

ExploitThird Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.