WP Edit Username
WP Edit Username has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2023; all 2 are fixed as of September 2026. Their average CVSS score is 4.4, and the most serious one scores 4.4 out of 10. 2023 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).
Every one of the 2 issues recorded for WP Edit Username has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. WP Edit Username is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2023-47527WP Edit Username <= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
Read the full analysisVulnerability Records

WP Edit Username
Author
Sajjad Hossain Sagor
This plugin adds feature to edit/change user username. Features: Edit Username: Allows editing of usernames. Only users with the edit_other_users() capability can change usernames. If the “Send Email” option is enabled, the user will receive a notification email when their username is changed. You can customize the email subject and body text in the admin dashboard or via filter hooks. Modify the email subject using the filter: wpeu_email_subject. Modify the email headers using the filter: wpeu_email_headers. Adjust the email body content using the filter wpeu_email_body. (Note: $new_username and $old_username are automatically prepended to the email content). Hooks Usage: <?php add_filter( 'wp_username_changed_email_subject', 'change_email_subject' ); function change_email_subject( $subject ) { $subject = 'Your customized subject'; return $subject; } add_filter( 'wp_username_changed_email_body', 'change_email_body' ); function change_email_body( $old_username, $new_username ) { $email_body = "Your custom email text body."; return $email_body; } ?>
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C