High
CVE-2026-103085
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 12
Reset filters
Medium
CVE-2026-94079
WP User Manager – User Profile Builder & Membership <= 2.9.19 - Missing Authorization
Medium
CVE-2026-18345
WP User Manager <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback
High
CVE-2026-49766
WP User Manager – User Profile Builder & Membership <= 2.9.16 - Authenticated (Subscriber+) Arbitrary File Deletion
High
CVE-2026-9290
WP User Manager <= 2.9.17 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter
Medium
CVE-2025-13320
WP User Manager <= 2.9.12 - Authenticated (Subscriber+) Arbitrary File Deletion via 'current_user_avatar' Parameter
High
CVE-2025-60245
User Manager <= 2.9.12 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2024-10216
WP User Manager – User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Carbon Fields Custom Sidebar Addition/Removal
Medium
CVE-2024-10537
WP User Manager – User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Authenticated (Subscriber+) User Meta Key Enumeration
Medium
CVE-2024-43336
WP User Manager <= 2.9.10 - Cross-Site Request Forgery
High
CVE-2021-24655
WP User Manager <= 2.6.2 - Arbitrary User Password Reset
Medium
CVE-2021-24654
User Registration < 2.0.2 - Authenticated Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.