wpusermanager vulnerabilities
6 published CVEs name wpusermanager among the affected products.
- 6Published CVEs6 of them scored
- 4Last 12 monthspublished in the last year
- 0Critical1 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-120550
WP User Manager <= 2.10.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' User Meta
wpusermanager · WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
Medium6.4 - CVE-2026-18345
WP User Manager <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback
wpusermanager · WP User Manager – User Profile Builder & Membership
Medium4.3 - CVE-2026-9290
WP User Manager <= 2.9.17 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter
wpusermanager · WP User Manager – User Profile Builder & Membership
High7.5 - CVE-2025-13320
WP User Manager <= 2.9.12 - Authenticated (Subscriber+) Arbitrary File Deletion via 'current_user_avatar' Parameter
wpusermanager · WP User Manager – User Profile Builder & Membership
Medium6.8 - CVE-2024-10537
WP User Manager – User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Authenticated (Subscriber+) User Meta Key Enumeration
wpusermanager · WP User Manager – User Profile Builder & Membership
Medium4.3 - CVE-2024-10216
WP User Manager – User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Carbon Fields Custom Sidebar Addition/Removal
wpusermanager · WP User Manager – User Profile Builder & Membership
Medium4.3