WP Edit Username

WP Edit Username has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2023; all 2 are fixed as of September 2026. Their average CVSS score is 4.4, and the most serious one scores 4.4 out of 10. 2023 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).

Every one of the 2 issues recorded for WP Edit Username has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. WP Edit Username is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium
4.4/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all WP Edit Username vulnerabilities before they are exploited.

Highest severity on recordCVSS 4.4CVE-2023-47527

WP Edit Username <= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings

Read the full analysis

Vulnerability Records

2 records
WP Edit Username banner
Latestv2.0.6
5.0(5)
100/100
Last Updated
2026-05-29 (4mo ago)
Active Installs
2,000+
Downloads
28,679
Requires WP
5.6+
Requires PHP
8.0+
Tested up to
WP 7.0.4
Created
2018-04-26 (9y ago)

This plugin adds feature to edit/change user username. Features: Edit Username: Allows editing of usernames. Only users with the edit_other_users() capability can change usernames. If the “Send Email” option is enabled, the user will receive a notification email when their username is changed. You can customize the email subject and body text in the admin dashboard or via filter hooks. Modify the email subject using the filter: wpeu_email_subject. Modify the email headers using the filter: wpeu_email_headers. Adjust the email body content using the filter wpeu_email_body. (Note: $new_username and $old_username are automatically prepended to the email content). Hooks Usage: <?php add_filter( 'wp_username_changed_email_subject', 'change_email_subject' ); function change_email_subject( $subject ) { $subject = 'Your customized subject'; return $subject; } add_filter( 'wp_username_changed_email_body', 'change_email_body' ); function change_email_body( $old_username, $new_username ) { $email_body = "Your custom email text body."; return $email_body; } ?>

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C