Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7 results
Aug 21, 2026AI Engine: Does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operationsCVE-2026-75796 · WordPress plugins & themes · reported by WPScanHigh 7.2
The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network, including the Network Administrator's.
- Product
- AI Engine
- Fixed in
- 3.6.1
- What to do
- Update AI Engine to 3.6.1 or newer.
Jul 8, 2026User Management: Authorization bypassCVE-2026-12097 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The User Management plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the plugin's export field configuration stored in the uiewp_export_field option, controlling which user fields such as password hashes are included in CSV exports and how columns are mapped during imports.
- Product
- User Management
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update User Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 5, 2025Ace User Management: Does not properly validate that a password reset token is associated with the user who requested itCVE-2025-6027 · WordPress plugins & themes · reported by WPScanMedium 6.3
The Ace User Management WordPress plugin through 2.0.3 does not properly validate that a password reset token is associated with the user who requested it, allowing any authenticated users, such as subscriber to reset the password of arbitrary accounts, including administrators.
- Product
- Ace User Management
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Ace User Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2025User Meta – User Profile Builder and User management: Arbitrary file deletionCVE-2025-9693 · WordPress plugins & themes · reported by WordfenceHigh 8
The User Meta – User Profile Builder and User management plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the postInsertUserProcess function in all versions up to, and including, 3.1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- Product
- User Meta – User Profile Builder and User management
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update User Meta – User Profile Builder and User management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 15, 2025User Management: Incorrect Privilege AssignmentCVE-2025-22736 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in Saad Iqbal User Management user-management allows Privilege Escalation.This issue affects User Management: from n/a through <= 1.2.
- Product
- User Management
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update User Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024User Management: Unrestricted Upload of File with Dangerous TypeCVE-2024-52403 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Saad Iqbal User Management user-management allows Upload a Web Shell to a Web Server.This issue affects User Management: from n/a through <= 1.1.
- Product
- User Management
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update User Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 8, 2024User Meta – User Profile Builder and User management: Insecure Direct Object ReferenceCVE-2024-9262 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The User Meta – User Profile Builder and User management plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.1 via the getUser() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to obtain user meta values from form fields. Please note that this requires a site administrator to create a form that displays potentially sensitive information like password hashes. This may also be exploited by unauthenticated users if the 'user-meta-public-profile' shortcode is used insecurely.
- Product
- User Meta – User Profile Builder and User management
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update User Meta – User Profile Builder and User management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.