Userswp
Monthly
Reflected cross-site scripting (XSS) in the UsersWP WordPress plugin through version 1.2.73 allows unauthenticated attackers to inject arbitrary JavaScript into a victim's browser by tricking them into clicking a crafted link. Successful exploitation can lead to session hijacking, data theft, or actions performed on behalf of the victim, especially if the victim has administrative privileges. No public exploit code or confirmed active exploitation exists at time of analysis; the CVSS score is 7.1 with a user-interaction requirement (UI:R).
Account takeover of any user of the UsersWP WordPress plugin - administrators included - is possible on sites running versions before 1.5.10 when social login is enabled, because the plugin resolves an incoming social-login session to an existing local account using the email address asserted by the provider without first confirming that the provider actually verified ownership of that address. The flaw is remotely reachable without authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, 8.1, CWE-269) and publicly available exploit code exists, so an attacker who registers at a lax or attacker-controlled provider can assert a victim's email and be logged into that victim's account. Exploitation carries the elevated complexity reflected in the AC:H rating: social login must be configured and enabled with at least one provider that permits assertion of an unverified address, and the attacker must already know the target's registered email. This is a genuinely high-priority vulnerability, not a high-CVSS-but-low-risk paper cut, since successful exploitation yields full account control including administrative takeover of the site.
Two-factor authentication bypass in the UsersWP WordPress plugin before 1.2.67 lets an attacker who already possesses a victim's username and password skip the second authentication factor and fully log in as that user. The two-factor login handler fails to validate the selected authentication provider (CWE-287), so the 2FA step can be circumvented. Publicly available exploit code exists and a vendor patch is released, but there is no public exploit identified as actively exploited in the wild.
Missing authorization checks in the UsersWP WordPress plugin (all versions through 1.2.74) allow an authenticated low-privilege user to perform privileged actions that modify site data, with no user interaction required on the victim's part. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), the barrier to exploitation is a valid low-privileged account - realistically a self-registered subscriber on sites that leave public registration open - after which the attacker gains a high-integrity impact without any data disclosure or denial of service. This is a moderate-risk broken access control (CWE-862) issue; no public exploit code and no confirmed active exploitation were identified at time of analysis.
The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could allow unauthenticated attackers to download them and retrieve sensitive. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uwp_sort_by’. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 32.4%.
The UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
A vulnerability in Stiofan UsersWP userswp.2.3.9. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. No vendor patch available.
The UsersWP WordPress plugin before 1.2.3.1 is missing access controls when updating a user avatar, and does not make sure file names for user avatars are unique, allowing a logged in user to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Reflected cross-site scripting (XSS) in the UsersWP WordPress plugin through version 1.2.73 allows unauthenticated attackers to inject arbitrary JavaScript into a victim's browser by tricking them into clicking a crafted link. Successful exploitation can lead to session hijacking, data theft, or actions performed on behalf of the victim, especially if the victim has administrative privileges. No public exploit code or confirmed active exploitation exists at time of analysis; the CVSS score is 7.1 with a user-interaction requirement (UI:R).
Account takeover of any user of the UsersWP WordPress plugin - administrators included - is possible on sites running versions before 1.5.10 when social login is enabled, because the plugin resolves an incoming social-login session to an existing local account using the email address asserted by the provider without first confirming that the provider actually verified ownership of that address. The flaw is remotely reachable without authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, 8.1, CWE-269) and publicly available exploit code exists, so an attacker who registers at a lax or attacker-controlled provider can assert a victim's email and be logged into that victim's account. Exploitation carries the elevated complexity reflected in the AC:H rating: social login must be configured and enabled with at least one provider that permits assertion of an unverified address, and the attacker must already know the target's registered email. This is a genuinely high-priority vulnerability, not a high-CVSS-but-low-risk paper cut, since successful exploitation yields full account control including administrative takeover of the site.
Two-factor authentication bypass in the UsersWP WordPress plugin before 1.2.67 lets an attacker who already possesses a victim's username and password skip the second authentication factor and fully log in as that user. The two-factor login handler fails to validate the selected authentication provider (CWE-287), so the 2FA step can be circumvented. Publicly available exploit code exists and a vendor patch is released, but there is no public exploit identified as actively exploited in the wild.
Missing authorization checks in the UsersWP WordPress plugin (all versions through 1.2.74) allow an authenticated low-privilege user to perform privileged actions that modify site data, with no user interaction required on the victim's part. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), the barrier to exploitation is a valid low-privileged account - realistically a self-registered subscriber on sites that leave public registration open - after which the attacker gains a high-integrity impact without any data disclosure or denial of service. This is a moderate-risk broken access control (CWE-862) issue; no public exploit code and no confirmed active exploitation were identified at time of analysis.
The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could allow unauthenticated attackers to download them and retrieve sensitive. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uwp_sort_by’. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 32.4%.
The UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
A vulnerability in Stiofan UsersWP userswp.2.3.9. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. No vendor patch available.
The UsersWP WordPress plugin before 1.2.3.1 is missing access controls when updating a user avatar, and does not make sure file names for user avatars are unique, allowing a logged in user to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.