Userswp Front End Login Form User Registration User Profile Members Directory Plugin For Wp
EUVD-2026-20846
|
CVE-2026-5742
MEDIUM
GHSA-88ch-mr98-cfqw
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents a moderate but contextually significant risk. The CVSS 6.4 score (Medium severity) reflects the network attack vector, low complexity, limited privileges required, and scope change; however, the confidence in that score is weakened by the absence of integrity and availability impacts (only confidentiality and integrity scored). The EPSS score and real-world exploitation data are not provided, but the low attack complexity and subscriber-level access requirement are typical of WordPress plugin vulnerabilities that see moderate adoption. The critical risk amplifier is the stored (persistent) nature of the XSS: unlike reflected XSS, this payload executes for every site visitor accessing the badge widget, not just the attacker's target. In WordPress sites with contributor or subscriber communities (e.g., membership sites, forums, multi-author blogs), subscriber-level compromise is common through weak passwords, reused credentials, or social engineering. The vulnerability is not listed as actively exploited (no CISA KEV status provided), and no public exploit code is referenced in the intelligence data, reducing immediate weaponization risk but not the strategic threat to vulnerable sites with untrusted user bases. For sites with strict subscriber access controls or single-author WordPress installations, real-world risk is lower; for community-driven sites, this warrants expedited patching. |
| Exploit ScenarioDerived | An attacker with a compromised subscriber account (or a malicious subscriber) edits their UsersWP profile and injects JavaScript into a URL field, for example: |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Stored Cross-Site Scripting in UsersWP WordPress plugin up to version 1.2.60 allows authenticated subscribers and above to inject arbitrary JavaScript into user profile badge widgets via insufficiently sanitized URL fields, executing malicious scripts for all site visitors viewing affected pages. The vulnerability affects the badge widget rendering component due to improper output escaping in the wp-ayecode-ui library integration. No public exploit code or active exploitation has been identified, though the low attack complexity and subscriber-level access requirement make this a realistic threat in multi-user WordPress environments.
RemediationAI
Upgrade the UsersWP plugin to a patched version released after 1.2.60 that includes input sanitization and output escaping fixes. The WordPress plugin repository changeset referenced (3501691@userswp) indicates upstream patches have been applied; users should update to the latest available version from the WordPress.org plugin directory. If an immediate upgrade is not feasible, site administrators should restrict subscriber-level user permissions on profile editing and disable the badge widget feature until patching is complete. Review audit logs for suspicious profile modifications by subscriber-level accounts that may indicate exploitation. For additional guidance, refer to the Wordfence threat intelligence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/bdb619c5-967c-4b8c-8a93-bcdb49137d56?source=cve and the WordPress plugin repository source code references detailing the vulnerable components.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation) in the UsersWP plugin's badge widget implementation. The root cause involves two distinct failures: insufficient input sanitization of user-supplied URL fields stored in the database and inadequate output escaping when rendering profile data through the wp-ayecode-ui component library, specifically in the AUI button component class. The affected code is located in class-aui-component-button.php (line 53 onwards) and pages.php (lines 392-540, particularly lines 522-527), which handle badge widget generation. When a user with subscriber-level or higher permissions submits a profile update containing malicious JavaScript within URL fields, the unescaped output is stored and subsequently rendered to all site visitors, resulting in persistent client-side code execution within the security context of the affected WordPress site.
Know when Userswp Front End Login Form User Registration User Profile Members Directory Plugin For Wp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The UsersWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.2.60. This is due to insufficient input sanitization of user-supplied URL fields and improper output escaping when rendering user profile data in badge widgets. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts that will execute whenever a user accesses a page containing the affected badge widget.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Userswp Front End Login Form User Registration User Profile Members Directory Plugin For Wp
View allArbitrary file deletion in UsersWP ≤ 1.2.70 for WordPress allows authenticated Subscriber-level users to delete any file
Unauthenticated attackers can recover the shared password protecting UsersWP's 25 built-in dummy user accounts - in all
Stored Cross-Site Scripting in the UsersWP WordPress plugin (all versions through 1.2.69) allows authenticated attackers
Blind Server-Side Request Forgery in UsersWP WordPress plugin versions up to 1.2.58 allows authenticated subscribers and
Improper access control in UsersWP plugin for WordPress versions up to 1.2.58 allows authenticated subscribers and above
Insecure Direct Object Reference in the UsersWP WordPress plugin (versions through 1.2.63) allows authenticated editor-l
Exploit-DB