WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wp-user-frontend
Published
2026-09-01
Title
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission < 4.3.11 - Authenticated (Subscriber+) PHP Object Injection
Slug
wp-user-frontend
Published
2026-09-28
Title
WP User Frontend 2.5.8 - 4.3.11 - Unauthenticated Account Creation with Registration Disabled
Slug
wp-user-frontend
Published
2026-09-28
Title
WP User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation via Registration Role Encryption
Slug
wp-user-frontend
Published
2026-09-28
Title
WP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated Form
Slug
wp-user-frontend
Published
2026-09-23
Title
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission < 4.3.12 - Authenticated (Subscriber+) Arbitrary File Deletion
Slug
wp-user-frontend
Published
2026-10-29
Title
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission < 4.3.14 - Missing Authorization
Slug
wp-user-frontend
Published
2026-10-29
Title
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission < 4.3.14 - Missing Authorization
Slug
wp-user-frontend
Published
2026-10-09
Title
User Frontend < 4.3.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter
Slug
wp-user-frontend
Published
2026-10-28
Title
WP User Frontend < 4.3.14 - Reflected XSS via 'field_attr' Parameter
Slug
wp-user-frontend
Published
2026-10-30
Title
User Frontend < 4.3.14 - Reflected Cross-Site Scripting via 'field_attr[required]' Parameter
Slug
wp-user-frontend
Published
2026-10-30
Title
User Frontend < 4.3.14 - Authenticated (Subscriber+) Privilege Escalation via post_content Parameter
Slug
wp-user-frontend-pro
Published
2025-06-04
Title
WP User Frontend Pro < 4.1.4 - Authenticated (Subscriber+) Arbitrary File Upload
Slug
wp-user-frontend-pro
Published
2025-06-04
Title
WP User Frontend Pro < 4.1.4 - Authenticated (Subscriber+) Arbitrary File Deletion
Slug
wp-user-frontend-pro
Published
2026-10-04
Title
WP User Frontend Pro <= 4.2.13 - Unauthenticated Stored Cross-Site Scripting
Slug
wp-user-groups
Published
2018-05-11
Title
WP User Groups < 2.1.0 - Cross-Site Request Forgery (CSRF)
Slug
wp-user-manager
Published
2021-09-22
Title
WP User Manager < 2.6.3 - Arbitrary User Password Reset to Account Compromise
Slug
wp-user-manager
Published
2024-08-16
Title
WP User Manager < 2.9.11 - Cross-Site Request Forgery
Slug
wp-user-manager
Published
2024-11-22
Title
WP User Manager – User Profile Builder & Membership < 2.9.12 - Missing Authorization to Carbon Fields Custom Sidebar Addition/Removal
Slug
wp-user-manager
Published
2024-11-22
Title
WP User Manager – User Profile Builder & Membership < 2.9.12 - Missing Authorization to Authenticated (Subscriber+) User Meta Key Enumeration
Slug
wp-user-manager
Published
2025-05-19
Title
User Manager < 2.9.13 - Authenticated (Subscriber+) PHP Object Injection
Slug
wp-user-manager
Published
2025-12-11
Title
WP User Manager < 2.9.13 - Authenticated (Subscriber+) Arbitrary File Deletion via 'current_user_avatar' Parameter
Slug
wp-user-manager
Published
2026-06-05
Title
WP User Manager < 2.9.18 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter
Slug
wp-user-manager
Published
2026-06-05
Title
WP User Manager – User Profile Builder & Membership < 2.9.17 - Authenticated (Subscriber+) Arbitrary File Deletion
Slug
wp-user-manager
Published
2026-09-22
Title
WP User Manager – User Profile Builder & Membership < 2.9.20 - Missing Authorization
Slug
wp-user-manager
Published
2026-10-03
Title
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory < 2.9.21 - Unauthenticated Privilege Escalation