WordPress User Extra Fields

Information

Software Type	Plugin
Software Slug	wp-user-extra-fields
Software Status	Active
Software Author	vanquish
Software Website	codecanyon.net
Software Active Installs	1,016
Software Record Last Updated	January 27, 2025

8 Vulnerabilities

Submit a Vulnerability

User Extra Fields <= 16.8 - Unauthenticated Stored Cross-Site Scripting

7.2

CVE-2025-67991

Feb 9, 2026

Researcher: Phat RiO

User Extra Fields <= 17.0 - Authenticated (Subscriber+) Arbitrary File Deletion

8.1

CVE-2025-69377

Feb 5, 2026

Researcher: Phat RiO

User Extra Fields <= 17.0 - Unauthenticated Arbitrary File Deletion

9.8

CVE-2025-69376

Feb 5, 2026

Researcher: Phat RiO

User Extra Fields <= 16.8 - Missing Authorization

5.3

CVE-2025-67579

Dec 15, 2025

Researcher: Phat RiO

WordPress User Extra Fields <= 16.7 - Authenticated (Subscriber+) Arbitrary File Deletion via save_fields Function

8.8

CVE-2025-7846

Oct 30, 2025

Researcher: Tonn

WordPress User Extra Fields <= 16.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

8.8

CVE-2024-10800

Nov 12, 2024

Researcher: Tonn

WordPress User Extra Fields <= 16.6 - Unauthenticated Arbitrary File Deletion

9.8

CVE-2024-11150

Nov 12, 2024

Researcher: Chloe Chamberland

WordPress User Extra Fields <= 16.5 - Unauthenticated Arbitrary File Upload

9.8

CVE-2024-10801

Nov 8, 2024

Researcher: Tonn

Title	Status	CVE ID	CVSS	Researchers	Date
User Extra Fields <= 16.8 - Unauthenticated Stored Cross-Site Scripting	Patched	CVE-2025-67991	7.2	Phat RiO	February 9, 2026
User Extra Fields <= 17.0 - Authenticated (Subscriber+) Arbitrary File Deletion	Unpatched	CVE-2025-69377	8.1	Phat RiO	February 5, 2026
User Extra Fields <= 17.0 - Unauthenticated Arbitrary File Deletion	Patched	CVE-2025-69376	9.8	Phat RiO	February 5, 2026
User Extra Fields <= 16.8 - Missing Authorization	Patched	CVE-2025-67579	5.3	Phat RiO	December 15, 2025
WordPress User Extra Fields <= 16.7 - Authenticated (Subscriber+) Arbitrary File Deletion via save_fields Function	Patched	CVE-2025-7846	8.8	Tonn	October 30, 2025
WordPress User Extra Fields <= 16.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation	Patched	CVE-2024-10800	8.8	Tonn	November 12, 2024
WordPress User Extra Fields <= 16.6 - Unauthenticated Arbitrary File Deletion	Patched	CVE-2024-11150	9.8	Chloe Chamberland	November 12, 2024
WordPress User Extra Fields <= 16.5 - Unauthenticated Arbitrary File Upload	Patched	CVE-2024-10801	9.8	Tonn	November 8, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation