CVE-2025-10003

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-10003

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-10003.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-10003

Published

2025-09-06T02:24:19.345Z

Modified

2026-07-15T01:49:14.717901423Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.44 - Authenticated (Subscriber+) SQL Injection

Details

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uploadfileremove’ function and 'htmlvar' parameter in all versions up to, and including, 1.2.44 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/10xxx/CVE-2025-10003.json",
    "cwe_ids": [
        "CWE-89"
    ],
    "cna_assigner": "Wordfence"
}

References

Affected packages

Git / github.com/ayecode/userswp

Affected ranges

Type

GIT

Repo

https://github.com/ayecode/userswp

Events

Introduced

Last affected

0238be451399671173d06a96eac4a3969c9bc76a

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.2.44"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*

1.0.1

1.0.10

1.0.11

1.0.12

1.0.13

1.0.14

1.0.15

1.0.16

1.0.17

1.0.18

1.0.19

1.0.2

1.0.20

1.0.21

1.0.22

1.0.23

1.0.24

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.1.0

1.1.1

1.1.2

1.1.3

1.2.0

1.2.0.1

1.2.0.10

1.2.0.11

1.2.0.12

1.2.0.2

1.2.0.3

1.2.0.4

1.2.0.5

1.2.0.6

1.2.0.7

1.2.0.8

1.2.0.9

1.2.1

1.2.1.1

1.2.1.2

1.2.1.3

1.2.1.4

1.2.1.5

1.2.1.6

1.2.1.7

1.2.1.8

1.2.1.9

1.2.10

1.2.11

1.2.12

1.2.13

1.2.14

1.2.15

1.2.16

1.2.17

1.2.18

1.2.19

1.2.2

1.2.2.1

1.2.2.10

1.2.2.11

1.2.2.12

1.2.2.13

1.2.2.14

1.2.2.15

1.2.2.16

1.2.2.17

1.2.2.18

1.2.2.19

1.2.2.2

1.2.2.20

1.2.2.21

1.2.2.22

1.2.2.23

1.2.2.24

1.2.2.25

1.2.2.26

1.2.2.27

1.2.2.28

1.2.2.29

1.2.2.3

1.2.2.30

1.2.2.31

1.2.2.32

1.2.2.33

1.2.2.34

1.2.2.35

1.2.2.36

1.2.2.37

1.2.2.4

1.2.2.5

1.2.2.6

1.2.2.7

1.2.2.8

1.2.2.9

1.2.20

1.2.23

1.2.24

1.2.25

1.2.26

1.2.27

1.2.28

1.2.29

1.2.3

1.2.3.1

1.2.3.10

1.2.3.11

1.2.3.12

1.2.3.13

1.2.3.14

1.2.3.15

1.2.3.16

1.2.3.17

1.2.3.18

1.2.3.19

1.2.3.2

1.2.3.20

1.2.3.21

1.2.3.22

1.2.3.23

1.2.3.24

1.2.3.3

1.2.3.4

1.2.3.5

1.2.3.6

1.2.3.7

1.2.3.8

1.2.3.9

1.2.30

1.2.31

1.2.32

1.2.33

1.2.34

1.2.35

1.2.36

1.2.37

1.2.38

1.2.39

1.2.4

1.2.40

1.2.41

1.2.42

1.2.43

1.2.44

1.2.5

1.2.6

1.2.7

1.2.8

1.2.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-10003.json"