wpusermanager CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM wpusermanager CVE published 2026-11-06

CVE-2026-120550

The WP User Manager plugin for WordPress has a Stored Cross-Site Scripting vulnerability via the 'name (REST users endpoint) -> wp_users.display_name' parameter in all versions up to, and including, 2.10.2. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts, which will execute when a user accesses an injected page.