Skip to content
OpenAdvisories

Vendor

wpusermanager

6 known vulnerabilities.

Products

WP User Manager – User Profile Builder & Membership 5 WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory 1
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-120550

    WP User Manager <= 2.10.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' User Meta

    The WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name (REST users endpoint) -> wp_users.display_name' parameter in all versions up to, and i…

    wpusermanager WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory Web / CMS
  • Medium 4.3
    CVE-2026-18345

    WP User Manager <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback

    The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete() function in versions up to, and including, 2.9.18. The function is registered on the admin_init hook (whic…

    wpusermanager WP User Manager – User Profile Builder & Membership Web / CMS
  • Medium 6.8
    CVE-2025-13320

    WP User Manager <= 2.9.12 - Authenticated (Subscriber+) Arbitrary File Deletion via 'current_user_avatar' Parameter

    The WP User Manager plugin for WordPress is vulnerable to Arbitrary File Deletion in all versions up to, and including, 2.9.12. This is due to insufficient validation of user-supplied file paths in the profile update functionality combined with improper handl…

    wpusermanager WP User Manager – User Profile Builder & Membership Web / CMS
  • Medium 4.3
    CVE-2024-10537

    WP User Manager – User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Authenticated (Subscriber+) User Meta Key Enumeration

    The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the validate_user_meta_key() function in all versions up to, and including, 2.9.11. This makes it po…

    wpusermanager WP User Manager – User Profile Builder & Membership Web / CMS
  • Medium 4.3
    CVE-2024-10216

    WP User Manager – User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Carbon Fields Custom Sidebar Addition/Removal

    The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'add_sidebar' and 'remove_sidebar' functions in all versions up to, and including, 2.9.11.…

    wpusermanager WP User Manager – User Profile Builder & Membership Web / CMS