WP User <= 7.0 - Unauthenticated SQLi

The WP User WordPress plugin through 7.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users. id: CVE-2022-4049 info: name: WP User = 7.0 - Unauthenticated SQLi author: theamanrawat severity: critica...

CVE-2025-3054-Exploit

CVE-2025-3054 Exploit: Download here Details CVE ID : CVE-2025-3054 Published : June 5, 2025 CVSS : 8.8 Patch Available: No official patch yet Impact The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadfiles functi...

CVE-2021-25076

CVE-2021-25076-Exploit Wordpress Plugin WP User Frontend 3.5.26 - SQL-Injection Authenticated CVE description: The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL...

CVE-2026-9290

CVE-2026-9290 — WP User Manager LFI to RCE Exploit Pre-Auth Path Traversal via 'tab' Parameter → Local File Inclusion Overview CVE-2026-9290 is a high-severity CVSS 7.5 unauthenticated Local File Inclusion vulnerability in the WP User Manager – User Profile Builder & Membership WordPress plugin ≤...

CVE-2026-124413

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.10.4...

EUVD-2026-123373

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.10.4...

CVE-2026-124413 WordPress WP User Manager plugin <= 2.10.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.10.4...

CVE-2026-124413

The WP User Manager plugin for WordPress (versions

WordPress WP User Manager plugin <= 2.10.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by HeeDong Cho in WordPress Plugin WP User Manager versions = 2.10.4...

PT-2026-145129

The 6Storage Rentals plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 2.31.0. The vulnerability exists because the six storage portal registration AJAX handler — registered on wp ajax six storage portal...

PT-2026-145143

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.10.4...

CVE-2026-124413: WP User Manager: Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly…

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.10.4...

CVE-2026-121575

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.10.4...

EUVD-2026-119244

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.10.4...

CVE-2026-121575 WordPress WP User Manager plugin <= 2.10.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.10.4...

CVE-2026-121575

The WP User Manager plugin for WordPress (versions up to and including 2.10.4 ) contains a Missing Authorization vulnerability (CWE-862 ). This flaw allows for the exploitation of Incorrectly Configured Access Control Security Levels . The impact is categorized as Medium severity, with a CVSS 3.1...

WordPress WP User Manager plugin <= 2.10.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by elba.code in WordPress Plugin WP User Manager versions = 2.10.4...

CVE-2026-119473

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in properfraction ProfilePress wp-user-avatar allows Code Injection.This issue affects ProfilePress: from n/a through 4.17.7...

CVE-2026-119473 WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in properfraction ProfilePress wp-user-avatar allows Code Injection.This issue affects ProfilePress: from n/a through 4.17.7...

CVE-2026-119473

The ProfilePress WordPress plugin (versions n/a through 4.17.7 ) is vulnerable to a Content Injection vulnerability (specifically Basic XSS ) due to Improper Neutralization of Script-Related HTML Tags in a web page. This flaw exists within the wp-user-avatar component and allows for Code Injectio...