User Meta – User Profile Builder and User management plugin

User Meta – User Profile Builder and User management plugin has 7 disclosed vulnerabilities in the WordSec catalog, reported between 2014 and 2025; 5 are fixed and 2 remain unpatched as of September 2026. Their average CVSS score is 6.0, and the most serious one scores 8.0 out of 10. Severity breakdown: 0 critical and 1 high. 2025 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (29%). Other recurring categories include Path Traversal, Authorization Bypass Through User-Controlled Key.

5 of the records (71%) have a vendor fix, while 2 remain unpatched. The oldest unresolved one dates back to 2025.

6 independent researchers contributed these findings, most of them (2) reported by stealthcopter.

Strategic Overview

Avg CVSSMedium

6.0/ 10

Patch Coverage71%

Open

Fixed

Get automatic notifications for all User Meta – User Profile Builder and User management plugin vulnerabilities before they are exploited.

Most severe open issueCVSS 8.0CVE-2025-9693

User Meta – User Profile Builder and User management plugin <= 3.1.2 - Authenticated (Subscriber+) Arbitrary File Deletion

Read the full analysis

Vulnerability Records

7 records


2025-09-10 18:50	User Meta – User Profile Builder and User management plugin <= 3.1.2 - Authenticated (Subscriber+) Arbitrary File Deletion User Meta <= 3.1.2	`CVE-2025-9693`	8.0 High	Kishan Vyas	No
2025-05-22 00:00	User Meta <= 3.1.2 - Reflected Cross-Site Scripting User Meta <= 3.1.2	`CVE-2025-47611`	6.1 Medium	stealthcopter	No
2024-11-08 14:02	User Meta – User Profile Builder and User management plugin <= 3.1.1 - Insecure Direct Object Reference to Sensitive Information Exposure User Meta <= 3.1.1	`CVE-2024-9262`	6.5 Medium	wesley (wcraft)	Yes
2024-04-25 00:00	User Meta <= 3.0 - Unauthenticated Sensitive Information Exposure User Meta <= 3.0	`CVE-2024-33575`	5.3 Medium	stealthcopter	Yes
2022-05-16 00:00	User Meta – User Profile Builder and User management plugin <= 2.4.3 - Path Traversal User Meta < 2.4.4	`CVE-2022-0779`	4.3 Medium	Julien Ahrens	Yes
2022-05-09 00:00	User Meta <= 2.4.2 - Authenticated (Admin+) Cross-Site Scripting User Meta <= 2.4.2	`CVE-2022-0376`	5.5 Medium	Niraj Mahajan	Yes
2014-08-01 00:00	User Meta – User Profile Builder and User management plugin 1.1.1 - Arbitrary File Upload User Meta 1.1.1	`N/A`	6.5 Medium	Adrien Thierry	Yes

Showing 1–7 of 7 reports