CSRF
6 records23.1%First: 2023. Latest: 2026.
Plugin security history
UserPro - Community and User Profile WordPress Plugin Vulnerability History & Security Timeline
The Wordfence Intelligence dataset currently contains 26 vulnerability records associated with UserPro - Community and User Profile WordPress Plugin, published between 2017 and 2026.
Dataset last synchronized: 2026-08-03 00:31:25 UTC
At a glance
Security Snapshot
26Total records
7Critical
4High
15Medium
0Low
0Informational
20Patched records
6Currently marked unpatched
2017-11-10First disclosure
2026-04-15Latest disclosure
24 of 26CVE coverage
Year-by-Year Timeline
| Year | Records | Relative volume |
|---|---|---|
| 2017 | 1 | |
| 2018 | 2 | |
| 2019 | 2 | |
| 2023 | 12 | |
| 2024 | 6 | |
| 2025 | 2 | |
| 2026 | 1 |
Severity Breakdown
| Severity | Records | Share |
|---|---|---|
| Critical | 7 | 26.9% |
| High | 4 | 15.4% |
| Medium | 15 | 57.7% |
Vulnerability-Type Breakdown
Cross-Site Scripting
4 records15.4%First: 2018. Latest: 2024.
Missing Authorization
4 records15.4%First: 2023. Latest: 2025.
Authentication Bypass
3 records11.5%First: 2017. Latest: 2024.
Privilege Escalation
3 records11.5%First: 2018. Latest: 2023.
Other
3 records11.5%First: 2023. Latest: 2024.
Information Disclosure
1 record3.8%First: 2023. Latest: 2023.
SQL Injection
1 record3.8%First: 2024. Latest: 2024.
Path Traversal
1 record3.8%First: 2025. Latest: 2025.
Patch Status
- Patched
- 20
- Currently marked unpatched
- 6
- Unknown status
- 0
Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.
Latest Known Patched Versions
5.1.115.1.95.1.75.1.65.1.15.1.55.1.24.9.35.14.9.214.9.284.9.244.9.17.1
Affected-Version History
Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.
| Affected range | Vulnerability | Published | Patched version | Severity |
|---|---|---|---|---|
[*, 5.1.11) | UserPro - Community and User Profile WordPress Plugin < 5.1.11 - Cross-Site Request Forgery | April 15, 2026 | 5.1.11 | Medium |
*-5.1.9 | Userpro <= 5.1.9 - Missing Authorization | December 25, 2025 | Not supplied | Medium |
*-5.1.10 | UserPro - Community and User Profile WordPress Plugin <= 5.1.10 - Unauthenticated Arbitrary File Read | June 13, 2025 | Not supplied | Medium |
*-5.1.9 | Userpro <= 5.1.9 - Authenticated (Contributor+) SQL Injection | December 19, 2024 | Not supplied | Medium |
*-5.1.9 | Userpro <= 5.1.9 - Missing Authorization | December 19, 2024 | Not supplied | Medium |
*-5.1.9 | Userpro <= 5.1.9 - Unauthenticated Local File Inclusion | December 19, 2024 | Not supplied | Critical |
*-5.1.9 | Userpro <= 5.1.9 - Reflected Cross-Site Scripting | December 19, 2024 | Not supplied | Medium |
5.1.8 | UserPro <= 5.1.8 - Unauthenticated Account Takeover to Privilege Escalation | May 21, 2024 | 5.1.9 | Critical |
*-5.1.6 | UserPro <= 5.1.6 - Disabled Membership Registration Bypass | February 1, 2024 | 5.1.7 | Medium |
5.1.5 | UserPro <= 5.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode | November 30, 2023 | 5.1.6 | Medium |
*-5.1.0 | UserPro <= 5.1.0 - Cross-Site Request Forgery to PHP Object Injection | November 21, 2023 | 5.1.1 | High |
*-5.1.1 | UserPro <= 5.1.1 - Cross-Site Request Forgery via multiple functions | November 21, 2023 | 5.1.2 | Medium |
*-5.1.4 | UserPro <= 5.1.4 - Authenticated (Subscriber+) Privilege Escalation | November 21, 2023 | 5.1.5 | High |
*-5.1.1 | UserPro <= 5.1.1 - Insecure Password Reset Mechanism | November 21, 2023 | 5.1.2 | Critical |
*-5.1.1 | UserPro <= 5.1.1 - Authentication Bypass to Administrator | November 21, 2023 | 5.1.2 | Critical |
*-5.1.0 | UserPro <= 5.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via userpro_save_userdata | November 21, 2023 | 5.1.1 | Medium |
*-5.1.4 | UserPro <= 5.1.4 - Missing Authorization to Arbitrary Shortcode Execution via userpro_shortcode_template | November 21, 2023 | 5.1.5 | Medium |
*-5.1.1 | UserPro <= 5.1.1 - Cross-Site Request Forgery to Privilege Escalation | November 21, 2023 | 5.1.2 | High |
*-5.1.1 | UserPro <= 5.1.1 - Missing Authorization via multiple functions | November 21, 2023 | 5.1.2 | High |
*-5.1.1 | UserPro <= 5.1.1 - Sensitive Information Disclosure via Shortcode | November 21, 2023 | 5.1.2 | Medium |
*-5.1.1 | UserPro <= 5.1.1 - Cross-Site Request Forgery to Sensitive Information Exposure | November 21, 2023 | 5.1.2 | Medium |
*-4.9.34 | UserPro <= 4.9.34 - Reflected Cross-Site Scripting | August 25, 2019 | 4.9.35.1 | Medium |
[*, 4.9.21) | UserPro <= 4.9.20 - Privilege Escalation | January 3, 2019 | 4.9.21 | Critical |
[*, 4.9.28) | UserPro <= 4.9.27 - Privilege Escalation | September 10, 2018 | 4.9.28 | Critical |
*-4.9.23 | UserPro <= 4.9.23 - Unauthenticated Cross-Site Scripting | August 31, 2018 | 4.9.24 | Medium |
Selected source records
Latest Records
MediumCVE-2025-53444
UserPro - Community and User Profile WordPress Plugin < 5.1.11 - Cross-Site Request Forgery
Published: April 15, 2026
- Affected versions
- [*, 5.1.11)
- Patched versions
- 5.1.11
MediumCVE-2025-68608
Userpro <= 5.1.9 - Missing Authorization
Published: December 25, 2025
- Affected versions
- *-5.1.9
- Patched versions
- Not supplied
MediumCVE-2025-4187
UserPro - Community and User Profile WordPress Plugin <= 5.1.10 - Unauthenticated Arbitrary File Read
Published: June 13, 2025
- Affected versions
- *-5.1.10
- Patched versions
- Not supplied
MediumCVE-2024-56210
Userpro <= 5.1.9 - Reflected Cross-Site Scripting
Published: December 19, 2024
- Affected versions
- *-5.1.9
- Patched versions
- Not supplied
CriticalCVE-2024-56214
Userpro <= 5.1.9 - Unauthenticated Local File Inclusion
Published: December 19, 2024
- Affected versions
- *-5.1.9
- Patched versions
- Not supplied
MediumCVE-2024-56211
Userpro <= 5.1.9 - Missing Authorization
Published: December 19, 2024
- Affected versions
- *-5.1.9
- Patched versions
- Not supplied
MediumCVE-2024-56212
Userpro <= 5.1.9 - Authenticated (Contributor+) SQL Injection
Published: December 19, 2024
- Affected versions
- *-5.1.9
- Patched versions
- Not supplied
CriticalCVE-2024-35700
UserPro <= 5.1.8 - Unauthenticated Account Takeover to Privilege Escalation
Published: May 21, 2024
- Affected versions
- 5.1.8
- Patched versions
- 5.1.9
Highest-Severity Records
Critical
UserPro <= 4.9.20 - Privilege Escalation
Published: January 3, 2019
- Affected versions
- [*, 4.9.21)
- Patched versions
- 4.9.21
CriticalCVE-2024-35700
UserPro <= 5.1.8 - Unauthenticated Account Takeover to Privilege Escalation
Published: May 21, 2024
- Affected versions
- 5.1.8
- Patched versions
- 5.1.9
CriticalCVE-2024-56214
Userpro <= 5.1.9 - Unauthenticated Local File Inclusion
Published: December 19, 2024
- Affected versions
- *-5.1.9
- Patched versions
- Not supplied
CriticalCVE-2017-16562
UserPro <= 4.9.17 - Authentication Bypass
Published: November 10, 2017
- Affected versions
- [*, 4.9.17.1)
- Patched versions
- 4.9.17.1
CriticalCVE-2023-2437
UserPro <= 5.1.1 - Authentication Bypass to Administrator
Published: November 21, 2023
- Affected versions
- *-5.1.1
- Patched versions
- 5.1.2
Critical
UserPro <= 4.9.27 - Privilege Escalation
Published: September 10, 2018
- Affected versions
- [*, 4.9.28)
- Patched versions
- 4.9.28
CriticalCVE-2023-2449
UserPro <= 5.1.1 - Insecure Password Reset Mechanism
Published: November 21, 2023
- Affected versions
- *-5.1.1
- Patched versions
- 5.1.2
HighCVE-2023-2440
UserPro <= 5.1.1 - Cross-Site Request Forgery to Privilege Escalation
Published: November 21, 2023
- Affected versions
- *-5.1.1
- Patched versions
- 5.1.2
Currently Marked Unpatched Records
MediumCVE-2025-68608
Userpro <= 5.1.9 - Missing Authorization
Published: December 25, 2025
- Affected versions
- *-5.1.9
- Patched versions
- Not supplied
MediumCVE-2025-4187
UserPro - Community and User Profile WordPress Plugin <= 5.1.10 - Unauthenticated Arbitrary File Read
Published: June 13, 2025
- Affected versions
- *-5.1.10
- Patched versions
- Not supplied
MediumCVE-2024-56210
Userpro <= 5.1.9 - Reflected Cross-Site Scripting
Published: December 19, 2024
- Affected versions
- *-5.1.9
- Patched versions
- Not supplied
CriticalCVE-2024-56214
Userpro <= 5.1.9 - Unauthenticated Local File Inclusion
Published: December 19, 2024
- Affected versions
- *-5.1.9
- Patched versions
- Not supplied
MediumCVE-2024-56211
Userpro <= 5.1.9 - Missing Authorization
Published: December 19, 2024
- Affected versions
- *-5.1.9
- Patched versions
- Not supplied
MediumCVE-2024-56212
Userpro <= 5.1.9 - Authenticated (Contributor+) SQL Injection
Published: December 19, 2024
- Affected versions
- *-5.1.9
- Patched versions
- Not supplied
Need help reviewing an exposed WordPress website?
Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.
Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.
Data Source, Attribution and Methodology
This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.