WP User Manager – User Profile Builder & Membership — Vulnerabilities & Security Advisories 5

All 5 CVE vulnerabilities found in WP User Manager – User Profile Builder & Membership, with AI-generated Chinese analysis, references, and POCs.

Vendor: Unknown

CVE ID	Title	CVSS	Severity	Published
CVE-2026-9290	WP User Manager <= 2.9.17 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter CWE-22	7.5	High	2026-06-05
CVE-2025-13320	WP User Manager <= 2.9.12 - Authenticated (Subscriber+) Arbitrary File Deletion via 'current_user_avatar' Parameter CWE-73	6.8	Medium	2025-12-12
CVE-2024-10537	WP User Manager – User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Authenticated (Subscriber+) User Meta Key Enumeration CWE-862	4.3	Medium	2024-11-23
CVE-2024-10216	WP User Manager – User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Carbon Fields Custom Sidebar Addition/Removal CWE-862	4.3	Medium	2024-11-23
CVE-2021-24655	WP User Manager < 2.6.3 - Arbitrary User Password Reset to Account Compromise CWE-639	7.5	-	2022-07-17

All 5 known CVE vulnerabilities affecting WP User Manager – User Profile Builder & Membership with full Chinese analysis, references, and POCs where available.