Wpusermanager

Wp User Manager

8 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
9.9

CVE-2026-49766

  • EPSS 0.51%
  • Veröffentlicht 15.06.2026 20:19:24
  • Zuletzt bearbeitet 15.06.2026 21:24:32

Subscriber Arbitrary File Deletion in WP User Manager <= 2.9.16 versions.

7.5

CVE-2026-9290

  • EPSS 2.4%
  • Veröffentlicht 05.06.2026 23:28:26
  • Zuletzt bearbeitet 08.06.2026 14:57:14

The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.17 via the (profile template scope) function. This makes it possible for unauthenticated atta...

6.8

CVE-2025-13320

  • EPSS 0.69%
  • Veröffentlicht 12.12.2025 03:20:51
  • Zuletzt bearbeitet 15.04.2026 00:35:42

The WP User Manager plugin for WordPress is vulnerable to Arbitrary File Deletion in all versions up to, and including, 2.9.12. This is due to insufficient validation of user-supplied file paths in the profile update functionality combined with impro...

9.8

CVE-2025-60245

  • EPSS 0.42%
  • Veröffentlicht 06.11.2025 15:55:19
  • Zuletzt bearbeitet 15.04.2026 00:35:42

Deserialization of Untrusted Data vulnerability in WP User Manager WP User Manager wp-user-manager allows Object Injection.This issue affects WP User Manager: from n/a through <= 2.9.12.

4.3

CVE-2024-10216

  • EPSS 0.43%
  • Veröffentlicht 23.11.2024 04:15:07
  • Zuletzt bearbeitet 07.02.2025 17:17:00

The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'add_sidebar' and 'remove_sidebar' functions in all versions up to, and including...

4.3

CVE-2024-10537

  • EPSS 0.37%
  • Veröffentlicht 23.11.2024 04:15:07
  • Zuletzt bearbeitet 07.02.2025 17:17:18

The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the validate_user_meta_key() function in all versions up to, and including, 2.9.11. This ma...

4.3

CVE-2024-43336

  • EPSS 0.17%
  • Veröffentlicht 26.08.2024 21:15:28
  • Zuletzt bearbeitet 23.04.2026 15:18:54

Cross-Site Request Forgery (CSRF) vulnerability in WP User Manager WP User Manager wp-user-manager.This issue affects WP User Manager: from n/a through <= 2.9.10.

7.5

CVE-2021-24655

Exploit
  • EPSS 0.83%
  • Veröffentlicht 17.07.2022 11:15:08
  • Zuletzt bearbeitet 21.11.2024 05:53:30

The WP User Manager WordPress plugin before 2.6.3 does not ensure that the user ID to reset the password of is related to the reset key given. As a result, any authenticated user can reset the password (to an arbitrary value) of any user knowing only...