UserPro v5.1.16 WordPress Plugin
UserPro is an all-in-one plugin that helps you create a complete community website with beautiful front-end profiles, login, and registration functionality for WordPress. It offers a wide range of features, including social connect and integration, viral marketing, user badges, verified accounts, content restriction, public/private activity feeds, and more. UserPro is designed to provide a comprehensive solution for building a vibrant and engaging community around your website.
Core Features of UserPro WordPress Plugin
- Beautiful front-end user profiles
- Seamless login and registration process
- Social connect and integration (ability to connect with social media accounts)
- Viral marketing tools
- User badges and achievements (manual or automatic assignment, custom badge uploads)
- Verified accounts feature
- Content restriction (full page/post restriction based on user roles or verified accounts)
- Site-wide or specific page locking for logged-out users
- Follow/Unfollow feature (users can follow/unfollow other community members)
- Social activity stream (public and private feeds showing recent user activities)
- Member listing layouts (standard table format, collage layout, customized lists)
- Member directory search with standard and custom filter options
- Enhanced members directory
- Front-end publisher (users can publish content directly from the front-end)
- Posts made by user (display posts by author dynamically, including on user profiles)
- Fully responsive design
- Shortcodes for displaying followers, following, and more
- Integration with custom post types and post categories
- User role management and permissions
- Customizable styling and branding options
- Translation-ready and multilingual support
- Regular updates and maintenance
What’s New (Changelog) in UserPro v5.1.16
v5.1.16 (06 Oct 2026)
- Security fix: Privilege escalation (CVSS 9.8, unauthenticated).
A guest registration could overwrite the new account's wp_capabilities
row by posting a field name containing a Unicode homoglyph in place of an
ASCII letter (e.g. U+0209 replacing 'i' in wp_capabilities). MySQL's
accent-insensitive meta_key collation matched the mutated key to the real
wp_capabilities row, and the previous remove_accents() denylist did not
cover all characters in that equivalence class.
Fixed in two layers:
(1) functions/ajax.php now applies sanitize_key() to every POST key when
building the form array, stripping all non-ASCII bytes before they
reach update_user_meta().
(2) functions/user-functions.php now rejects any meta key containing
non-ASCII bytes outright and uses sanitize_key() rather than
remove_accents() for the capabilities/user_level denylist, as
defense-in-depth for any caller that does not go through ajax.php.
Reported by YC_Infosec via Patchstack, 2026-10-06.
Similar Plugins
Download UserPro Latest Version
- 1 UserPro DashBoard v3.7 1 month agoProvides Dashboard for every user .
- 2 MemberList Layouts for UserPro v1.0 1 month agoUnique layouts of the UserPro Memberlist
- 3 Private Messages Add-on for UserPro v4.9.2 1 month agoAllow users to send a message to each other, view/manage messages, and block users.
- 4 Social Wall Add-on for UserPro v4.4 1 month agoAllow users to post, comment and interact with each other.
- 5 Tags add-on for UserPro v1.2 1 month agoAllow users to add tags to their profiles easily
- 6 WooCommerce integration for UserPro v1.7 1 month agoIntegrates woocommerce orders and purchases with UserPro profiles
