WordPress security by component

WordPress User Extra Fields

Plugin description

WordPress User Extra Fields is a WordPress component with 2 published CVE records in this archive. The latest tracked vulnerability was published Oct 31, 2025; the highest CVE/CNA score is 9.8.

Plugin slug: wordpress-user-extra-fields

Latest vulnerability

CVE-2025-7846: WordPress User Extra Fields: Code execution

WordPress User Extra Fields is affected by code execution. Exploitation requires at least subscriber-level access. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

PublishedOct 31, 2025

Safe version guidanceSee mitigation notes

		Safe version
Oct 31, 2025	CVE-2025-7846 WordPress User Extra Fields: Code execution WordPress User Extra Fields is affected by code execution. Exploitation requires at least subscriber-level access. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVE8.8 NVDPending
Nov 09, 2024	CVE-2024-10801 WordPress User Extra Fields: Dangerous file upload WordPress User Extra Fields is affected by dangerous file upload. The vulnerable path is reachable without authentication. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.	See mitigation notes	CVE9.8 NVDPending