Wwpusermanager

Products

Exploited and recent CVEs

• CVE-2026-18345 Medium 4.3 WP User Manager <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback 0.3%
• CVE-2026-9290 High 7.5 WP User Manager <= 2.9.17 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter 2.5%
• CVE-2025-13320 Medium 6.8 WP User Manager <= 2.9.12 - Authenticated (Subscriber+) Arbitrary File Deletion via 'current_user_avatar' Parameter 0.8%
• CVE-2024-10537 Medium 4.3 WP User Manager – User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Authenticated (Subscriber+) User Meta Key Enumeration 0.4%
• CVE-2024-10216 Medium 4.3 WP User Manager – User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Carbon Fields Custom Sidebar Addition/Removal 0.4%