WordPress users-ultra has 7 known advisories in the phpwarden feed. Feed 2026.10.29.4, updated 2026-10-29.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2022-0769 | The Users Ultra WordPress plugin through 3.1.0 fails to properly sanitize and escape the data_target parameter before it is being interpolat | critical | 9.8 | <=3.1.0 | – |
| CVE-2015-4109 | Multiple SQL injection vulnerabilities in the ratings module in the Users Ultra plugin before 1.5.16 for WordPress allow remote attackers to | high | 7.5 | <=1.5.15 | – |
| CVE-2015-9402 | The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload. | high | 8.8 | <1.5.59 | 1.5.59 |
| CVE-2015-9395 | The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action. | high | 8.8 | <1.5.64 | 1.5.64 |
| CVE-2015-9392 | The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter. | medium | 5.4 | <1.5.63 | 1.5.63 |
| CVE-2015-9393 | The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter. | medium | 5.4 | <1.5.63 | 1.5.63 |
| CVE-2015-9394 | The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php. | high | 8.8 | <1.5.63 | 1.5.63 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# PHP projects (recommended) composer require --dev phpwarden/phpwarden # then vendor/bin/phpwarden wordpress /var/www/html # or, without Composer pipx install phpwarden && phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked