Skip to content
OpenAdvisories

Product · gm_alex

User Access Manager

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-19797

    User Access Manager <= 2.3.18 - Reflected Cross-Site Scripting via 'tab_group_section' Parameter

    The User Access Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab_group_section' parameter in all versions up to, and including, 2.3.18 due to insufficient input sanitization and output escaping. This makes it possible …

    gm_alex User Access Manager Web / CMS
  • Medium 6.5
    CVE-2026-15281

    User Access Manager <= 2.3.12 - Authenticated (Subscriber+) SQL Injection

    The User Access Manager plugin for WordPress is vulnerable to Second-Order SQL Injection via the 'id' parameter of the wp_ajax_save-attachment-compat AJAX action in versions up to, and including, 2.3.12. This is due to insufficient validation on the objectId …

    gm_alex User Access Manager Web / CMS