Unknown Wp User vulnerabilities

• unknown wp user manager, wp user manager user manager +1 more WP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registration Role After Stripe Disconnect CVE-2026-110523 8.1 HighOctober 21, 2026
• unknown wp user manager, wp user manager user manager +1 more WP User Manager 2.9 - 2.9.19 - Unauthenticated Account Creation via Stripe Registration Payment Bypass CVE-2026-110527 5.3 MediumOctober 17, 2026
• unknown wp user frontend WP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated Form CVE-2026-79618 4.3 MediumOctober 2, 2026
• unknown wp user profile avatar, wp event manager user profile avatar +1 more WP User Profile Avatar <= 1.0.1 - Contributor+ Stored XSS CVE-2023-6067 5.4 MediumApril 15, 2024
• unknown wp user profile avatar, wp event manager user profile avatar +1 more WP User Profile Avatar < 1.0.1 - Author+ Avatar Deletion/Update via IDOR CVE-2023-6384 4.3 MediumJanuary 22, 2024
• unknown wp user, wp user project user +1 more WP User <= 7.0 - Unauthenticated SQLi CVE-2022-4049 9.8 CriticalJanuary 2, 2023
• unknown wp user merger, wp user merger project user merger +1 more WP User Merger < 1.5.3 - Admin+ SQLi via ID CVE-2022-3865 8.8 HighNovember 28, 2022
• unknown wp user merger, wp user merger project user merger +1 more WP User Merger < 1.5.3 - Admin+ SQLi via wpsu_user_id CVE-2022-3848 8.8 HighNovember 28, 2022
• unknown wp user merger, wp user merger project user merger +1 more WP User Merger < 1.5.3 - Admin+ SQLi via user_id CVE-2022-3849 8.8 HighNovember 28, 2022
• unknown wp user frontend WP User Frontend < 3.5.29 - Obscure Registration as Admin CVE-2021-24649 9.8 CriticalNovember 21, 2022
• wpusermanager wp user manager, unknown wp user manager – user profile builder & membership +1 more WP User Manager < 2.6.3 - Arbitrary User Password Reset to Account Compromise CVE-2021-24655 7.5 HighJuly 17, 2022
• wp user project user, unknown wp user – custom registration forms, login and user profile +1 more WP User < 7.0 - Reflected Cross-Site Scripting CVE-2021-25034 6.1 MediumFebruary 28, 2022
• wedevs wp user frontend, unknown wp user frontend – membership, profile, registration & post submission plugin for wordpress +1 more WP User Frontend < 3.5.26 - SQL Injection to Reflected Cross-Site Scripting CVE-2021-25076 Public exploit EPSS 17.3% 8.8 HighJanuary 24, 2022
• profilepress user registration\, login form\, user profile \& membership, unknown user registration, login form, user profile & membership – profilepress (formerly wp user avatar) +1 more ProfilePress < 3.2.3 - Reflected Cross-Site Scripting CVE-2021-24955 6.1 MediumDecember 13, 2021
• profilepress user registration\, login form\, user profile \& membership, unknown user registration, login form, user profile & membership – profilepress (formerly wp user avatar) +1 more ProfilePress < 3.2.3 - Reflected Cross-Site Scripting CVE-2021-24954 6.1 MediumDecember 13, 2021
• properfraction profilepress, unknown user registration, user profile, login & membership – profilepress (formerly wp user avatar) +1 more ProfilePress < 3.1.11 - Unauthenticated Cross-Site Scripting (XSS) in tabbed login/register widget CVE-2021-24522 6.1 MediumAugust 9, 2021
• properfraction profilepress, unknown user registration, user profiles, login & membership – profilepress (formerly wp user avatar) +1 more ProfilePress < 3.1.8 - Authenticated Stored XSS CVE-2021-24450 4.8 MediumAugust 2, 2021