What’s Vulnerable › Products
stiofansisland UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP vulnerabilities
18 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 12 published in the last 12 months.
Latest stiofansisland UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP vulnerabilities
- CVE-2026-86814 — UsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider Email (CVSS 8.1)
- CVE-2026-19991 — UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion (CVSS 8.1)
- CVE-2026-18501 — UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution (CVSS 6.4)
- CVE-2026-13690 — UsersWP < 1.2.67 - Two-Factor Authentication Bypass (CVSS 7.4)
- CVE-2026-13492 — UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field (CVSS 8.8)
- CVE-2026-12102 — UsersWP <= 1.2.63 - Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user_id' Parameter (CVSS 2.7)
- CVE-2026-4979 — UsersWP <= 1.2.58 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter (CVSS 5.0)
- CVE-2026-4977 — UsersWP <= 1.2.58 - Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter (CVSS 4.3)
- CVE-2026-5742 — UsersWP <= 1.2.60 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link Substitution (CVSS 6.4)
- CVE-2025-10003 — UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.44 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5)
- CVE-2025-9344 — UsersWP <= 1.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- CVE-2024-43277 — WordPress UsersWP plugin <= 1.2.15 - Broken Access Control vulnerability (CVSS 5.3)
- CVE-2024-6477 — UsersWP < 1.2.12 - Users Information Disclosure (CVSS 7.5)
- CVE-2024-6265 — UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress <= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort_by' (CVSS 9.8)
- CVE-2024-31936 — WordPress UsersWP plugin < 1.2.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- CVE-2024-2423 — UsersWP <= 1.2.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- CVE-2022-47442 — WordPress UsersWP Plugin <= 1.2.3.9 is vulnerable to CSV Injection (CVSS 8.8)
- CVE-2022-0442 — UsersWP < 1.2.3.1 - Subscriber+ User Avatar Override (CVSS 4.3)