EUVD-2026-53926
GHSA-36vj-955x-m2pp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
PR:L for required subscriber authentication; UI:R corrected from vendor UI:N since victim must visit the injected page to trigger stored XSS.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and including, 1.2.69 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the UsersWP WordPress plugin (all versions through 1.2.69) allows authenticated attackers with subscriber-level access to inject persistent JavaScript payloads via unsanitized variable substitution in the Badge Widget. The vulnerability stems from two distinct unsanitized code paths - the uwp_get_user_badge() function's %%input%% and %%profile_url%% template substitutions, and the uwp_replace_variables() function - both of which fail to apply esc_html() or esc_url() before rendering user-controlled values into page output. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Technical ContextAI
The affected product is the UsersWP plugin for WordPress, identified by CPE cpe:2.3:a:stiofansisland:userswp_-_front-end_login_form,_user_registration,_user_profile_&_members_directory_plugin_for_wp:*:*:*:*:*:*:*:* across all versions up to and including 1.2.69. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a failure to escape output before HTML rendering. The PR diff shows that in includes/helpers/pages.php, the uwp_get_user_badge() function substituted the %%input%% placeholder directly with $match_value and %%profile_url%% with an unescaped URL, and uwp_replace_variables() passed scalar user profile values into page output without esc_html(). A secondary issue in includes/class-import-export.php also skipped sanitize_* functions on CSV import fields. The badge widget feature acts as the injection vector because it performs template variable substitution using subscriber-editable profile data that is then stored and rendered for all page visitors.
RemediationAI
The upstream fix is available in GitHub PR #919 (https://github.com/AyeCode/userswp/pull/919/changes), which applies esc_html() to the %%input%% substitution and esc_url() to the %%profile_url%% substitution in uwp_get_user_badge(), adds esc_html() to scalar values in uwp_replace_variables(), and applies sanitize_text_field(), sanitize_user(), sanitize_email(), and sanitize_textarea_field() to CSV import fields. The plugin's .po language file in the same PR is stamped as version 1.2.70, strongly indicating 1.2.70 is the patched release; however, a released tagged version on WordPress.org has not been independently confirmed from the available references - site operators should verify plugin version 1.2.70 or later is available in the WordPress plugin repository and update immediately. As a compensating control while awaiting the update, administrators should restrict subscriber-level registration or disable the Badge Widget feature if it is not operationally required; disabling open registration reduces the attacker pool to already-credentialed internal users. Restricting which user roles can edit badge-related profile fields further limits the injection surface.
More in Userswp Front End Login Form User Registration User Profile Members Directory Plugin For Wp
View allArbitrary file deletion in UsersWP ≤ 1.2.70 for WordPress allows authenticated Subscriber-level users to delete any file
Stored Cross-Site Scripting in UsersWP WordPress plugin up to version 1.2.60 allows authenticated subscribers and above
Blind Server-Side Request Forgery in UsersWP WordPress plugin versions up to 1.2.58 allows authenticated subscribers and
Improper access control in UsersWP plugin for WordPress versions up to 1.2.58 allows authenticated subscribers and above
Insecure Direct Object Reference in the UsersWP WordPress plugin (versions through 1.2.63) allows authenticated editor-l
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today