CVE-2026-120550

Name of the Vulnerable Software and Affected Versions WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory versions prior to 2.10.3

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs when arbitrary web scripts are injected via the wp users.display name parameter within the REST users endpoint. The payload is stored using the WordPress core REST endpoint 'POST /wp-json/wp/v2/users/me', which bypasses the wpum sanitize text sanitizer used on the front-end account form. These scripts execute whenever a user accesses a page containing the injected content.

Recommendations Update to a version newer than 2.10.2.