User Meta Manager

User Meta Manager has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2015 and 2023; 3 are fixed and 2 remain unpatched as of September 2026. Their average CVSS score is 7.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 3 high. 2023 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (20%). Other recurring categories include Cross-Site Scripting, Exposure Of Sensitive Information To An Unauthorized Actor.

3 of the records (60%) have a vendor fix, while 2 remain unpatched. The oldest unresolved one dates back to 2023.

3 independent researchers contributed these findings, most of them (3) reported by Panagiotis Vagenas.

Strategic Overview

Avg CVSSHigh

7.8/ 10

Patch Coverage60%

Open

Fixed

Get automatic notifications for all User Meta Manager vulnerabilities before they are exploited.

Most severe open issueCVSS 8.8CVE-2023-23712

User Meta Manager <= 3.4.9 - Cross Site Request Forgery

Read the full analysis

Vulnerability Records

5 records


2023-01-19 00:00	User Meta Manager <= 3.4.9 - Reflected Cross-Site Scripting User Meta Manager <= 3.4.9	`CVE-2023-22718`	6.3 Medium	minhtuanact	No
2023-01-10 00:00	User Meta Manager <= 3.4.9 - Cross Site Request Forgery User Meta Manager <= 3.4.8	`CVE-2023-23712`	8.8 High	thiennv	No
2016-02-02 00:00	User Meta Manager Plugin < 3.4.7 - Privilege Escalation User Meta Manager < 3.4.7	`N/A`	8.8 High	Panagiotis Vagenas	Yes
2016-02-01 00:00	User Meta Manager < 3.4.8 - Missing Authorization to Sensitive Information Disclosure User Meta Manager < 3.4.8	`N/A`	6.5 Medium	Panagiotis Vagenas	Yes
2015-02-04 00:00	User Meta Manager < 3.4.7 - Authenticated Blind SQL Injection User Meta Manager < 3.4.7	`N/A`	8.8 High	Panagiotis Vagenas	Yes

Showing 1–5 of 5 reports