{"id":"CVE-2026-120550","kind":"vulnerability","aliases":["CVE-2026-120550"],"related":[],"title":"WP User Manager WordPress plugin: stored XSS via display name","description":"The WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name (REST users endpoint) -> wp_users.display_name' parameter in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is stored via the WordPress core REST endpoint POST /wp-json/wp/v2/users/me, which bypasses the plugin's own wpum_sanitize_text sanitizer applied on its front-end account form, making the save-time sanitization ineffective as a mitigation.","summary":"The WP User Manager plugin for WordPress up to and including 2.10.2 does not sanitize the display name saved through the core REST users endpoint. An authenticated subscriber can store a script in their display name that runs in the browser of anyone who views the injected page.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-user-manager"],"not_affected_if":["plugin-not-installed","registration-closed","version-above-2.10.2"],"how_to_check":"- Check the installed version of the WP User Manager plugin in the WordPress admin plugins list, or in the plugin's header in `wp-content/plugins/wp-user-manager/`\n- Confirm whether subscriber-level accounts can self-register on the site","fix":"- WP User Manager: a version later than `2.10.2` (fixed version not stated in the sources)","status":"open","published_at":"2026-11-06T10:16:37+00:00","first_seen_at":"2026-11-06T10:40:56+00:00","triaged_at":"2026-11-06T10:41:21+00:00","updated_at":"2026-11-06T10:41:21+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-06T10:41:21Z","model":"claude-haiku-5-5","output":{"fix":"- WP User Manager: a version later than `2.10.2` (fixed version not stated in the sources)","reach":"internet","title":"WP User Manager WordPress plugin: stored XSS via display name","impact":"medium","summary":"The WP User Manager plugin for WordPress up to and including 2.10.2 does not sanitize the display name saved through the core REST users endpoint. An authenticated subscriber can store a script in their display name that runs in the browser of anyone who views the injected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-user-manager","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"yes","worst_case":"Script runs in other users' browsers, enabling session theft or actions as them","analyst_note":"Confirm the first fixed version of WP User Manager from the plugin changelog or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120550.","how_to_check":"- Check the installed version of the WP User Manager plugin in the WordPress admin plugins list, or in the plugin's header in `wp-content/plugins/wp-user-manager/`\n- Confirm whether subscriber-level accounts can self-register on the site","plain_action":"","needs_analyst":true,"not_affected_if":["registration-closed","plugin-not-installed","version-above-2.10.2"],"who_is_affected":"Sites running WP User Manager 2.10.2 or earlier where users can register or log in with a subscriber-level account. The flaw is reached through WordPress core's REST users endpoint, so the plugin's own front-end form sanitizer does not protect it. Sites with registration closed and no subscriber accounts are much less exposed.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.00076,"input_tokens":4403,"output_tokens":639,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120550':13A,16A '-2026':12A,15A '/wp-json/wp/v2/users/me':165C '2.10.2':37B,114C 'access':134C,150C 'account':182C 'anyon':68B 'appli':176C 'arbitrari':139C 'attack':129C 'authent':52B,128C 'browser':66B 'builder':84C 'bypass':167C 'core':47B,161C 'cross':95C 'cross-sit':94C 'cve':11A,14A 'directori':86C 'display':9A,42B,60B 'due':115C 'end':181C 'endpoint':50B,103C,163C 'escap':122C 'execut':146C 'form':79C,81C,183C 'front':180C 'front-end':179C 'host':20B 'includ':36B,113C 'ineffect':190C 'inject':72B,138C,152C 'input':118C 'insuffici':117C 'level':133C 'login':80C 'make':124C,184C 'manag':3A,25B,29B,77C 'member':85C 'mitig':193C 'name':10A,43B,61B,100C,105C 'output':121C 'packag':17B 'page':73B,143C,153C 'paramet':106C 'payload':155C 'plugin':5A,30B,87C,169C 'possibl':126C 'post':164C 'profil':83C 'registr':78C 'rest':48B,101C,162C 'run':63B 'sanit':40B,119C,173C,175C,189C 'save':44B,187C 'save-tim':186C 'script':57B,97C,141C 'self':19B 'self-host':18B 'site':96C 'store':6A,55B,93C,157C 'subscrib':53B,132C 'subscriber-level':131C 'text':174C 'time':188C 'user':2A,24B,28B,49B,76C,82C,102C,149C 'version':109C 'via':8A,98C,158C 'view':70B 'vulner':91C 'web':140C 'whenev':147C 'wordpress':4A,21B,32B,89C,160C 'wp':1A,23B,27B,75C 'wp-user-manag':22B 'wp_users.display':104C 'wpum':172C 'xss':7A","nicknames":[],"mitigations":[],"who_affected":"Sites running WP User Manager 2.10.2 or earlier where users can register or log in with a subscriber-level account. The flaw is reached through WordPress core's REST users endpoint, so the plugin's own front-end form sanitizer does not protect it. Sites with registration closed and no subscriber accounts are much less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","wordpress","wpusermanager"],"campaign_type":null,"search_a":"'-120550':13A,16A '-2026':12A,15A 'cve':11A,14A 'display':9A 'manag':3A 'name':10A 'plugin':5A 'store':6A 'user':2A 'via':8A 'wordpress':4A 'wp':1A 'xss':7A","search_b":"'2.10.2':37B 'anyon':68B 'authent':52B 'browser':66B 'core':47B 'display':42B,60B 'endpoint':50B 'host':20B 'includ':36B 'inject':72B 'manag':25B,29B 'name':43B,61B 'packag':17B 'page':73B 'plugin':30B 'rest':48B 'run':63B 'sanit':40B 'save':44B 'script':57B 'self':19B 'self-host':18B 'store':55B 'subscrib':53B 'user':24B,28B,49B 'view':70B 'wordpress':21B,32B 'wp':23B,27B 'wp-user-manag':22B","search_c":"'/wp-json/wp/v2/users/me':165C '2.10.2':114C 'access':134C,150C 'account':182C 'appli':176C 'arbitrari':139C 'attack':129C 'authent':128C 'builder':84C 'bypass':167C 'core':161C 'cross':95C 'cross-sit':94C 'directori':86C 'due':115C 'end':181C 'endpoint':103C,163C 'escap':122C 'execut':146C 'form':79C,81C,183C 'front':180C 'front-end':179C 'includ':113C 'ineffect':190C 'inject':138C,152C 'input':118C 'insuffici':117C 'level':133C 'login':80C 'make':124C,184C 'manag':77C 'member':85C 'mitig':193C 'name':100C,105C 'output':121C 'page':143C,153C 'paramet':106C 'payload':155C 'plugin':87C,169C 'possibl':126C 'post':164C 'profil':83C 'registr':78C 'rest':101C,162C 'sanit':119C,173C,175C,189C 'save':187C 'save-tim':186C 'script':97C,141C 'site':96C 'store':93C,157C 'subscrib':132C 'subscriber-level':131C 'text':174C 'time':188C 'user':76C,82C,102C,149C 'version':109C 'via':98C,158C 'vulner':91C 'web':140C 'whenev':147C 'wordpress':89C,160C 'wp':75C 'wp_users.display':104C 'wpum':172C","first_public_at":"2026-11-06T10:16:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120550","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120550","severity":null,"published_at":"2026-11-06T10:16:37+00:00","modified_at":"2026-11-06T10:16:37+00:00","first_seen_at":"2026-11-06T10:40:56+00:00","fetched_at":"2026-11-06T10:40:56+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}