Deluxethemes vulnerabilities

Products

• Userpro 7
• Media Manager For Userpro 2
• Private Messages For Userpro 2

Newest

• deluxethemes userpro WordPress Userpro plugin < 5.1.11 - Cross Site Request Forgery (CSRF) vulnerability CVE-2025-53444 4.3 MediumApril 15, 2026
• deluxethemes userpro WordPress Userpro plugin <= 5.1.9 - Broken Access Control vulnerability CVE-2025-68608 7.5 HighDecember 24, 2025
• deluxethemes media manager for userpro, userproplugin media manager +1 more Media Manager for UserPro <= 3.12.0 - Missing Authorization to Unauthenticated Arbitrary Options Update CVE-2024-12822 9.8 CriticalJanuary 30, 2025
• deluxethemes media manager for userpro, userproplugin media manager +1 more Media Manager for UserPro <= 3.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update CVE-2024-12821 8.8 HighJanuary 30, 2025
• deluxethemes private messages for userpro WordPress Private Messages for UserPro plugin <= 4.10.0 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2025-22322 7.1 HighJanuary 21, 2025
• deluxethemes private messages for userpro WordPress Private Messages for UserPro plugin <= 4.10.0 - Local File Inclusion vulnerability CVE-2025-22311 7.5 HighJanuary 21, 2025
• deluxethemes userpro WordPress UserPro plugin <= 5.1.9 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2024-56210 7.1 HighDecember 31, 2024
• deluxethemes userpro WordPress UserPro plugin <= 5.1.9 - SQL Injection vulnerability CVE-2024-56212 8.5 HighDecember 31, 2024
• deluxethemes userpro WordPress UserPro plugin <= 5.1.9 - Authenticated Arbitrary User Meta Update vulnerability CVE-2024-56211 8.8 HighDecember 31, 2024
• deluxethemes userpro WordPress UserPro plugin <= 5.1.9 - Local File Inclusion vulnerability CVE-2024-56214 8.3 HighDecember 31, 2024
• deluxethemes userpro WordPress UserPro plugin <= 5.1.8 - Unauthenticated Account Takeover vulnerability CVE-2024-35700 9.8 CriticalJune 4, 2024