CVE-2026-120550

The WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name REST users endpoint - wpusers.displayname' parameter in all versions up to, and including, 2.10.2 due to insufficient input...

CVE-2026-120550

The WP User Manager plugin for WordPress (versions up to and including 2.10.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping in the name parameter of the REST users endpoint (wp_users.display_name). This allows authenti...

CVE-2026-120550 WP User Manager <= 2.10.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' User Meta

The WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name REST users endpoint - wpusers.displayname' parameter in all versions up to, and including, 2.10.2 due to insufficient input...

EUVD-2026-118170

The WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name REST users endpoint - wpusers.displayname' parameter in all versions up to, and including, 2.10.2 due to insufficient input...

WordPress WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory plugin <= 2.10.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin WP User Manager versions = 2.10.2...

CVE-2026-9290

CVE-2026-9290 — WP User Manager LFI to RCE Exploit Pre-Auth Path Traversal via 'tab' Parameter → Local File Inclusion Overview CVE-2026-9290 is a high-severity CVSS 7.5 unauthenticated Local File Inclusion vulnerability in the WP User Manager – User Profile Builder & Membership WordPress plugin ≤...

opnsense-uidfield-system-uid0

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · opnsense-uidfield-system-uid0 Write-up: https://abraxaslabs.tech/research/opnsense-uidfield-system-uid0 opnsense-uidfield-system-uid0 Class: Privilege leftover Reach: Remote OPNsense core 26.7.6 a842fe48 - opnsense.or...

CVE-2026-116846

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.26...

EUVD-2026-112861

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.26...

CVE-2026-116846

The WP User Manager WordPress plugin (versions up to and including 2.9.26 ) is vulnerable to a Missing Authorization flaw. This vulnerability allows attackers to exploit incorrectly configured access control security levels within the wp-user-manager component. The impact includes a breach of sec...

CVE-2026-116846 WordPress WP User Manager plugin <= 2.9.26 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.26...

WordPress WP User Manager plugin <= 2.9.26 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by mroccon in WordPress Plugin WP User Manager versions = 2.9.26...

WordPress WP User Manager authorization issue vulnerability

WordPress WP User Manager versions 2.9.26 and earlier contain an authorization issue vulnerability. This vulnerability stems from insufficient authorization checks, which may allow attackers to exploit improperly configured access control levels...

PT-2026-132159

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.26...

CVE-2026-116846: WP User Manager: Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly…

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.26...

WordPress WP User Manager plugin 2.9.21-2.9.25 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Charles Vosburgh in WordPress Plugin WP User Manager versions 2.9.21-2.9.25...

CVE-2026-110523

The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and...

CVE-2026-110523

The WP User Manager WordPress plugin versions prior to 2.9.26 is vulnerable to unauthenticated privilege escalation . The flaw occurs because the plugin fails to maintain paid-registration restrictions once a payment gateway is disconnected. Consequently, a published paid registration form will s...

EUVD-2026-107069

The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and...

CVE-2026-110523 WP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registration Role After Stripe Disconnect

The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and...