WP User Groups
WP User Groups has one disclosed vulnerability in the WordSec catalog, all reported in 2018; it is fixed as of September 2026. Their average CVSS score is 8.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).
The one issue recorded for WP User Groups has a vendor fix available, so running the current release closes it.
All of these findings were reported by Mallory Adams. WP User Groups is installed on roughly 600 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
WP User Groups <= 2.1.0 - Cross-Site Request Forgery
Read the full analysisVulnerability Records
WP User Groups
Author
John James Jacoby
WP User Groups allows users to be categorized using custom taxonomies & terms. “Groups” & “Types” are created by default, and can be overridden More user group types can be registered with custom arguments Edit users and set their relationships Bulk edit many users to quickly assign several at once Filter the users list to see which users are in what groups Not destructive data storage (plugin can be enabled & disabled without damage) Works great with all WP User & Term plugins (see below) Recommended Plugins If you like this plugin, you’ll probably like these! WP User Profiles WP User Activity WP User Avatars WP User Groups WP User Signups WP Term Authors WP Term Colors WP Term Families WP Term Icons WP Term Images WP Term Locks WP Term Order WP Term Visibility WP Media Categories WP Pretty Filters WP Chosen
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C