UsersWP Plugin CVE-2026-18501

Exploitation requires an authenticated WordPress account with at minimum subscriber-level role on the target site - unauthenticated exploitation is not possible per the CVSS PR:L vector. The site must have the UsersWP plugin installed and active in version 1.2.69 or earlier, and the Badge Widget feature must be in use on pages accessible to other users. The XSS payload executes when any user (including administrators) accesses a page rendering the injected badge or variable output. Factors limiting exploitation: open subscriber registration must be enabled (or the attacker must already possess valid credentials), the Badge Widget or variable substitution feature must be deployed on the site, and the attack is stored-and-triggered rather than reflected, requiring victim navigation to the affected page.

The CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects a network-reachable, low-complexity attack requiring only subscriber-level authentication with a scope change (S:C), indicating payload execution in a victim's browser context rather than the server. The PR:L metric confirms authentication is required - this is not an unauthenticated attack surface. The UI:N designation in the NVD/Wordfence vector warrants scrutiny: stored XSS inherently requires a victim to visit the injected page, which most CVSS practitioners would score as UI:R; this discrepancy should be noted when prioritizing against other UI:N findings. No EPSS data was provided, and the CVE is not in the CISA KEV catalog, indicating no confirmed mass or targeted exploitation at time of analysis. The S:C flag does elevate real-world impact - a subscriber-level attacker can target administrators who visit member profile or badge-display pages, potentially enabling privilege escalation via session hijacking or admin credential theft. This is a realistic intra-site privilege escalation scenario for multi-tenant WordPress deployments with open subscriber registration.

An attacker registers a subscriber-level account on a WordPress site running UsersWP 1.2.69 or earlier and crafts a malicious profile value (e.g., display name or a badge-linked custom field) containing a JavaScript payload such as a cookie-stealing script. When an administrator or other authenticated user browses to a member directory page or individual profile page that renders the badge widget, the stored payload executes in the victim's browser, potentially exfiltrating session cookies or triggering unauthorized admin actions. No public proof-of-concept exploit code has been identified at time of analysis.