UsersWP CVE-2026-94641

Exploitation requires an attacker to lure an authenticated or anonymous user into clicking a crafted URL targeting a UsersWP plugin endpoint that reflects attacker-controlled input without sanitization (reflected XSS). The decisive limiting factor is the mandatory user interaction (CVSS UI:R): the payload executes only when a victim loads the malicious link, so there is no server-side, interactionless path. No authentication is needed to craft or send the link (CVSS PR:N), but impact is maximized when the victim is a privileged WordPress user whose session/context the script can abuse. The UsersWP plugin must be installed and the vulnerable version (≤1.2.73) active on the target site.

This is a reflected cross-site scripting (CWE-79) flaw in the UsersWP WordPress plugin, scored CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The CVSS vector indicates a network-reachable, low-complexity, unauthenticated issue, but the HIGH-severity appearance is tempered by UI:R - the attack requires a victim to interact with an attacker-supplied link, so it cannot be exploited passively or at scale against unwitting servers. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Reflected XSS as a class is common and easily weaponized once a vulnerable parameter is known, but real-world impact here is bounded by the per-victim, social-engineering-dependent delivery model and the LOW confidentiality/integrity impact (session/context theft within the affected page rather than full server compromise). Net: a legitimate issue worth patching on exposed sites, but a moderate priority rather than an emergency - the high CVSS is driven by AV:N/PR:N and the scope change, not by evidence of mass exploitation. EPSS is absent, so probabilistic exploitation likelihood cannot be quantified from the provided data.

An attacker crafts a URL pointing at a UsersWP page (e.g., a profile, search, or registration view) with a malicious script payload in a reflected parameter, then delivers it to a logged-in administrator or user via phishing email, forum post, or malicious link. When the victim clicks, the unsanitized input is reflected into the page and the script executes in their browser session, enabling session cookie theft, CSRF-style actions, or content manipulation in the WordPress context. No public proof-of-concept was identified in the provided data.