Description

The WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name (REST users endpoint) -> wp_users.display_name' parameter in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is stored via the WordPress core REST endpoint POST /wp-json/wp/v2/users/me, which bypasses the plugin's own wpum_sanitize_text sanitizer applied on its front-end account form, making the save-time sanitization ineffective as a mitigation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-11-06T10:16:37.047Z",
  "pubdate": "2026-11-06T10:16:37.047Z",
  "executiveSummary": "The WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This flaw arises from inadequate input sanitization and output escaping within the 'name' parameter, specifically affecting the 'wp_users.display_name' field via the REST API.\nThe vulnerability allows authenticated attackers with subscriber-level privileges or higher to inject arbitrary JavaScript payloads. Because the injection occurs through the WordPress core REST endpoint (POST /wp-json/wp/v2/users/me) rather than the plugin's front-end forms, the plugin’s native 'wpum_sanitize_text' security control is effectively bypassed.\nSuccessful exploitation results in the execution of malicious scripts within the context of an administrator’s or other user's browser session. This poses a significant risk, including potential session hijacking, unauthorized administrative actions, or defacement. Given the nature of Stored XSS, the payload persists and triggers whenever an affected user accesses the compromised page, significantly increasing the risk of widespread impact across the WordPress environment.",
  "technicalDetails": "The vulnerability exists due to a discrepancy between the plugin's expected input handling and the underlying WordPress core behavior. While the WP User Manager plugin implements its own sanitization routine, 'wpum_sanitize_text', on its front-end account update forms, this logic is not enforced on the WordPress core REST API endpoint used for user profile updates.\nThe attack vector leverages the 'POST /wp-json/wp/v2/users/me' REST API endpoint. An attacker authenticated as a subscriber can send a specially crafted request to this endpoint, targeting the 'name' parameter. Since the REST API endpoint does not route through the plugin’s specific sanitization filters, the malicious script payload is stored directly into the 'wp_users.display_name' database field without undergoing sufficient sanitization or output encoding checks.\nThe exploitation flow is as follows: 1) An attacker with valid subscriber credentials authenticates to the target WordPress site. 2) The attacker crafts an HTTP POST request to '/wp-json/wp/v2/users/me' containing a JavaScript payload within the 'name' field. 3) The server processes the request and updates the 'display_name' field in the 'wp_users' table with the unsanitized malicious script. 4) When an unsuspecting user (such as an administrator) views the member directory or a profile page where 'display_name' is rendered, the WordPress application outputs the stored payload directly into the HTML context.\nBecause the payload is persisted in the database, the execution is automatic and triggered upon the rendering of the profile within the plugin's member directory or user profile components. The failure to apply context-aware output escaping allows the browser to interpret the injected script as valid code rather than plain text. This vulnerability affects all plugin versions up to and including 2.10.2. The lack of validation at the API layer allows for persistent and stealthy execution of JavaScript, which can be leveraged to perform actions on behalf of the victim, exfiltrate sensitive data, or redirect users to malicious domains."
}