UF
Product
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP
9
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 2Medium 6Low 1
Watch
Add UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-13492 | 8.8 | Jul 9 | UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field Affected: through 1.2.65 |
| CVE-2026-19991 | 8.1 | Sep 11 | UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion Affected: through 1.2.70 |
| CVE-2025-10003 | 6.5 | Sep 6 | UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.44 - Authenticated (Subscriber+) SQL Injection Affected: through 1.2.44 |
| CVE-2026-18501 | 6.4 | Aug 6 | UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution Affected: through 1.2.69 |
| CVE-2026-5742 | 6.4 | Apr 9 | UsersWP <= 1.2.60 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link Substitution Affected: through 1.2.60 |
| CVE-2025-9344 | 6.4 | Aug 28 | UsersWP <= 1.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 1.2.42 |
| CVE-2026-4979 | 5.0 | Apr 11 | UsersWP <= 1.2.58 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter Affected: through 1.2.58 |
| CVE-2026-4977 | 4.3 | Apr 10 | UsersWP <= 1.2.58 - Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter Affected: through 1.2.58 |
| CVE-2026-12102 | 2.7 | Jun 18 | UsersWP <= 1.2.63 - Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user_id' Parameter Affected: through 1.2.63 |
Showing 9