Plugin icon

WP User Manager – Registration Form, Login Form, User Profile & Member Directory

wp-user-manager

Vulnerabilities:

10

Last Updated:

September 27, 2026

Active Installs:

10000

Published
Title
Fixed in
CVSS
Published
2026-09-22
Title
WP User Manager – User Profile Builder & Membership < 2.9.20 - Missing Authorization
Fixed in
Fixed in 2.9.20
CVSS
5.3 (medium)
Published
2026-09-21
Title
WP User Manager < 2.9.19 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback
Fixed in
Fixed in 2.9.19
CVSS
4.3 (medium)
Published
2026-06-05
Title
WP User Manager – User Profile Builder & Membership < 2.9.17 - Authenticated (Subscriber+) Arbitrary File Deletion
Fixed in
Fixed in 2.9.17
CVSS
8.1 (high)
Published
2026-06-05
Title
WP User Manager < 2.9.18 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter
Fixed in
Fixed in 2.9.18
CVSS
7.5 (high)
Published
2025-12-11
Title
WP User Manager < 2.9.13 - Authenticated (Subscriber+) Arbitrary File Deletion via 'current_user_avatar' Parameter
Fixed in
Fixed in 2.9.13
CVSS
6.8 (medium)
Published
2025-05-19
Title
User Manager < 2.9.13 - Authenticated (Subscriber+) PHP Object Injection
Fixed in
Fixed in 2.9.13
CVSS
7.5 (high)
Published
2024-11-22
Title
WP User Manager – User Profile Builder & Membership < 2.9.12 - Missing Authorization to Carbon Fields Custom Sidebar Addition/Removal
Fixed in
Fixed in 2.9.12
CVSS
4.3 (medium)
Published
2024-11-22
Title
WP User Manager – User Profile Builder & Membership < 2.9.12 - Missing Authorization to Authenticated (Subscriber+) User Meta Key Enumeration
Fixed in
Fixed in 2.9.12
CVSS
4.3 (medium)
Published
2024-08-16
Title
WP User Manager < 2.9.11 - Cross-Site Request Forgery
Fixed in
Fixed in 2.9.11
CVSS
4.3 (medium)
Published
2021-09-22
Title
WP User Manager < 2.6.3 - Arbitrary User Password Reset to Account Compromise
Fixed in
Fixed in 2.6.3
CVSS
8.8 (high)