Wpusermanager vulnerabilities

Products

• Wp User Manager – User Profile Builder & Membership 6
• Wp User Manager 4

Newest

• wpusermanager wp user manager – user profile builder & membership WP User Manager <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback CVE-2026-18345 4.3 MediumSeptember 22, 2026
• wpusermanager wp user manager – user profile builder & membership WP User Manager <= 2.9.17 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter CVE-2026-9290 Public exploit 7.5 HighJune 5, 2026
• wpusermanager wp user manager – user profile builder & membership WP User Manager <= 2.9.12 - Authenticated (Subscriber+) Arbitrary File Deletion via 'current_user_avatar' Parameter CVE-2025-13320 6.8 MediumDecember 12, 2025
• wpusermanager wp user manager – user profile builder & membership, wp user manager +1 more WP User Manager – User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Authenticated (Subscriber+) User Meta Key Enumeration CVE-2024-10537 4.3 MediumNovember 23, 2024
• wpusermanager wp user manager – user profile builder & membership, wp user manager +1 more WP User Manager – User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Carbon Fields Custom Sidebar Addition/Removal CVE-2024-10216 4.3 MediumNovember 23, 2024
• wp user manager user manager, wpusermanager wp user manager +1 more WordPress WP User Manager – User Profile Builder & Membership plugin <= 2.9.10 - Cross Site Request Forgery (CSRF) vulnerability CVE-2024-43336 4.3 MediumAugust 26, 2024
• wpusermanager wp user manager, unknown wp user manager – user profile builder & membership +1 more WP User Manager < 2.6.3 - Arbitrary User Password Reset to Account Compromise CVE-2021-24655 7.5 HighJuly 17, 2022