UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP vulnerabilities

Product

UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP

by stiofansisland · last CVE Sep 11, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities11 In the news0 Timeline

Severity mix

Critical 1High 2Medium 7Low 1

Severity

All severities11 Critical1 High2 Medium7 Low1

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2025-10003	6.5	0%	Sep 6	UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.44 - Authenticated (Subscriber+) SQL Injection Affected: through 1.2.44
CVE-2026-18501	6.4	0%	Aug 6	UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution Affected: through 1.2.69
CVE-2026-5742	6.4	0%	Apr 9	UsersWP <= 1.2.60 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link Substitution Affected: through 1.2.60
CVE-2025-9344	6.4	0%	Aug 28	UsersWP <= 1.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 1.2.42
CVE-2024-2423	6.4	0%	Apr 9	UsersWP <= 1.2.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode Affected: through 1.2.6
CVE-2026-4979	5.0	0%	Apr 11	UsersWP <= 1.2.58 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter Affected: through 1.2.58
CVE-2026-4977	4.3	0%	Apr 10	UsersWP <= 1.2.58 - Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter Affected: through 1.2.58