WordPress plugin
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 21 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High6
- Medium15
- Low0
All WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium5.3 | Missing Authorization ≤2.10.4Update to 2.10.5 | CVE-2026-124413 | |
| Medium5.3 | Missing Authorization ≤2.10.4Update to 2.10.5 | CVE-2026-121575 | |
| Medium6.4 | Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' User Meta ≤2.10.2Update to 2.10.3 | CVE-2026-120550 | |
| Medium5.3 | Missing Authorization ≤2.9.26Update to 2.10.0 | CVE-2026-116846 | |
| Medium4.3 | Missing Authorization ≤2.9.25Update to 2.9.26 | CVE-2026-112823 | |
| High7.3 | 2.9.25 - Unauthenticated Privilege Escalation 2.9.21 – 2.9.25Update to 2.9.26 | CVE-2026-110523 | |
| Medium5.3 | 2.9.19 - Unauthenticated Payment Bypass 2.9 – 2.9.19Update to 2.9.20 | CVE-2026-110527 | |
| Medium5.3 | Missing Authorization ≤2.9.23Update to 2.9.24 | CVE-2026-108496 | |
| Medium4.3 | Missing Authorization ≤2.9.22Update to 2.9.23 | CVE-2026-107423 | |
| High7.3 | Unauthenticated Privilege Escalation ≤2.9.20Update to 2.9.21 | CVE-2026-103085 | |
| Medium5.3 | Missing Authorization ≤2.9.19Update to 2.9.20 | CVE-2026-94079 | |
| Medium4.3 | Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback ≤2.9.18Update to 2.9.19 | CVE-2026-18345 | |
| High7.5 | Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter ≤2.9.17Update to 2.9.18 | CVE-2026-9290 | |
| High8.1 | Authenticated (Subscriber+) Arbitrary File Deletion ≤2.9.16Update to 2.9.17 | CVE-2026-49766 | |
| Medium6.8 | Authenticated (Subscriber+) Arbitrary File Deletion via 'current_user_avatar' Parameter ≤2.9.12Update to 2.9.13 | CVE-2025-13320 | |
| High7.5 | Authenticated (Subscriber+) PHP Object Injection ≤2.9.12Update to 2.9.13 | CVE-2025-60245 | |
| Medium4.3 | Missing Authorization to Carbon Fields Custom Sidebar Addition/Removal ≤2.9.11Update to 2.9.12 | CVE-2024-10216 | |
| Medium4.3 | Missing Authorization to Authenticated (Subscriber+) User Meta Key Enumeration ≤2.9.11Update to 2.9.12 | CVE-2024-10537 | |
| Medium4.3 | Cross-Site Request Forgery ≤2.9.10Update to 2.9.11 | CVE-2024-43336 | |
| High7.5 | Arbitrary User Password Reset ≤2.6.2Update to 2.6.3 | CVE-2021-24655 | |
| Medium5.4 | Authenticated Stored Cross-Site Scripting <2.0.2Update to 2.0.2 | CVE-2021-24654 |
- Medium5.3Missing Authorization
≤2.10.4Update to 2.10.5
- Medium5.3Missing Authorization
≤2.10.4Update to 2.10.5
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' User Meta
≤2.10.2Update to 2.10.3
- Medium5.3Missing Authorization
≤2.9.26Update to 2.10.0
- Medium4.3Missing Authorization
≤2.9.25Update to 2.9.26
- High7.32.9.25 - Unauthenticated Privilege Escalation
2.9.21 – 2.9.25Update to 2.9.26
- Medium5.32.9.19 - Unauthenticated Payment Bypass
2.9 – 2.9.19Update to 2.9.20
- Medium5.3Missing Authorization
≤2.9.23Update to 2.9.24
- Medium4.3Missing Authorization
≤2.9.22Update to 2.9.23
- High7.3Unauthenticated Privilege Escalation
≤2.9.20Update to 2.9.21
- Medium5.3Missing Authorization
≤2.9.19Update to 2.9.20
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback
≤2.9.18Update to 2.9.19
- High7.5Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter
≤2.9.17Update to 2.9.18
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
≤2.9.16Update to 2.9.17
- Medium6.8Authenticated (Subscriber+) Arbitrary File Deletion via 'current_user_avatar' Parameter
≤2.9.12Update to 2.9.13
- High7.5Authenticated (Subscriber+) PHP Object Injection
≤2.9.12Update to 2.9.13
- Medium4.3Missing Authorization to Carbon Fields Custom Sidebar Addition/Removal
≤2.9.11Update to 2.9.12
- Medium4.3Missing Authorization to Authenticated (Subscriber+) User Meta Key Enumeration
≤2.9.11Update to 2.9.12
- Medium4.3Cross-Site Request Forgery
≤2.9.10Update to 2.9.11
- High7.5Arbitrary User Password Reset
≤2.6.2Update to 2.6.3
- Medium5.4Authenticated Stored Cross-Site Scripting
<2.0.2Update to 2.0.2
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory: common questions
Does WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory have known vulnerabilities?
Yes. VulnCrest Radar lists 21 known vulnerabilities in WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory: 6 high, 15 medium. None are known to affect version null.
How do I check which version of WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory vulnerability?
CVE-2026-124413, published Nov 11, 2026: WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.10.4 - Missing Authorization. Severity: Medium (CVSS 5.3).
Is any WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory vulnerability listed in CISA KEV?
No. None of the known WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory vulnerabilities is currently listed in the CISA KEV catalog.