← back to popular plugins
wordfence / plugin · userfeedback-lite
UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds
userfeedback-lite
total installs
200,000
total vulns
4
critical
0
high
0
medium
4
low
0
latest vuln
—
patched
4
unpatched
0
avg time to patch
—
vulnerabilities
(4)
User Feedback <= 1.10.1 - Missing Authorization
medium
✓ patched
The User Feedback plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.10.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.
User Feedback <= 1.10.1 - Authenticated (Editor+) SQL Injection
medium
✓ patched
cve id
CVE-2026-39475 ↗
cvss score
4.9
cwe
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
published
Feb 20, 2026
The User Feedback plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.10.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
User Feedback <= 1.10.0 - Authenticated (Editor+) SQL Injection
medium
✓ patched
cve id
CVE-2025-68496 ↗
cvss score
4.9
cwe
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
published
Dec 22, 2025
The User Feedback plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds <= 1.8.0 - Missing Authorization to Information Disclosure
medium
✓ patched
The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `maybe_load_onboarding_wizard` function in all versions up to, and including, 1.8.0. This makes it possible for unauthenticated attackers to access the onboarding wizard page and view configuration information including the administrator email address.