What’s Vulnerable › Products
WP User Manager vulnerabilities
14 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 12 published in the last 12 months.
Check whether your WP User Manager version is affected
Latest WP User Manager vulnerabilities
- CVE-2026-112823 — WordPress WP User Manager plugin <= 2.9.25 - Broken Access Control vulnerability (CVSS 4.3)
- CVE-2026-108496 — WordPress WP User Manager plugin <= 2.9.24 - Broken Access Control vulnerability (CVSS 5.3)
- CVE-2026-107423 — WordPress WP User Manager plugin <= 2.9.22 - Broken Access Control vulnerability (CVSS 4.3)
- CVE-2026-103085 — WordPress WP User Manager plugin <= 2.9.20 - Privilege Escalation vulnerability (CVSS 6.5)
- CVE-2026-94079 — WordPress WP User Manager plugin <= 2.9.19 - Broken Access Control vulnerability (CVSS 5.3)
- CVE-2026-18345 — WP User Manager <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback (CVSS 4.3)
- CVE-2026-49766 — WordPress WP User Manager plugin <= 2.9.16 - Arbitrary File Deletion vulnerability (CVSS 9.9)
- CVE-2026-9290 — WP User Manager <= 2.9.17 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter (CVSS 7.5)
- CVE-2025-13320 — WP User Manager <= 2.9.12 - Authenticated (Subscriber+) Arbitrary File Deletion via 'current_user_avatar' Parameter (CVSS 6.8)
- CVE-2025-60245 — WordPress WP User Manager plugin <= 2.9.12 - PHP Object Injection vulnerability (CVSS 9.8)
- CVE-2024-10537 — WP User Manager – User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Authenticated (Subscriber+) User Meta Key Enumeration (CVSS 4.3)
- CVE-2024-10216 — WP User Manager – User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Carbon Fields Custom Sidebar Addition/Removal (CVSS 4.3)
- CVE-2024-43336 — WordPress WP User Manager – User Profile Builder & Membership plugin <= 2.9.10 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- CVE-2021-24655 — WP User Manager < 2.6.3 - Arbitrary User Password Reset to Account Compromise (CVSS 7.5)