Userswp Front End Login Form User Registration User Profile Members Directory Plugin For Wp
Monthly
Arbitrary file deletion in UsersWP ≤ 1.2.70 for WordPress allows authenticated Subscriber-level users to delete any file on the server - including wp-config.php - via a path traversal bypass in the upload_file_remove() AJAX handler. The exploit exploits a two-phase validation failure: validate_file() only rejects literal '../' sequences, but the uwp_get_file_relative_url() helper later performs a global str_replace() that collapses crafted embedded tokens into directory traversal sequences after the final validation gate, with the result passed directly to wp_delete_file() without canonical containment. No public exploit code or CISA KEV listing is confirmed at time of analysis; however, the low privilege requirement and precise Wordfence source-level write-up substantially reduce the research barrier for threat actors.
Stored Cross-Site Scripting in the UsersWP WordPress plugin (all versions through 1.2.69) allows authenticated attackers with subscriber-level access to inject persistent JavaScript payloads via unsanitized variable substitution in the Badge Widget. The vulnerability stems from two distinct unsanitized code paths - the `uwp_get_user_badge()` function's `%%input%%` and `%%profile_url%%` template substitutions, and the `uwp_replace_variables()` function - both of which fail to apply `esc_html()` or `esc_url()` before rendering user-controlled values into page output. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Insecure Direct Object Reference in the UsersWP WordPress plugin (versions through 1.2.63) allows authenticated editor-level users to permanently delete or reset the avatar and banner images of any WordPress user account, including site administrators, by supplying an arbitrary user_id parameter. The vulnerability lies in missing authorization validation on the user_id key within image management handlers across class-forms.php, class-userswp.php, and class-profile.php, directly manipulating the uwp_usermeta table. No public exploit has been identified at time of analysis, and real-world severity is constrained by the high-privilege authentication prerequisite.
Blind Server-Side Request Forgery in UsersWP WordPress plugin versions up to 1.2.58 allows authenticated subscribers and above to force the WordPress server to make arbitrary HTTP requests via the uwp_crop parameter in avatar/banner image crop operations. The vulnerability stems from insufficient URL origin validation in the process_image_crop() method, which accepts user-controlled URLs and passes them to PHP image processing functions that support URL wrappers, enabling internal network reconnaissance and potential access to sensitive services. No public exploit code or active exploitation has been confirmed, though the vulnerability requires only authenticated access and low attack complexity.
Improper access control in UsersWP plugin for WordPress versions up to 1.2.58 allows authenticated subscribers and above to manipulate restricted user metadata fields via the upload_file_remove() AJAX handler, bypassing field-level permissions intended to restrict modifications to administrator-only fields. The vulnerability stems from insufficient validation of the $htmlvar parameter against allowed fields or admin-use restrictions, enabling attackers to clear or reset sensitive usermeta columns on their own user records.
Stored Cross-Site Scripting in UsersWP WordPress plugin up to version 1.2.60 allows authenticated subscribers and above to inject arbitrary JavaScript into user profile badge widgets via insufficiently sanitized URL fields, executing malicious scripts for all site visitors viewing affected pages. The vulnerability affects the badge widget rendering component due to improper output escaping in the wp-ayecode-ui library integration. No public exploit code or active exploitation has been identified, though the low attack complexity and subscriber-level access requirement make this a realistic threat in multi-user WordPress environments.
Arbitrary file deletion in UsersWP ≤ 1.2.70 for WordPress allows authenticated Subscriber-level users to delete any file on the server - including wp-config.php - via a path traversal bypass in the upload_file_remove() AJAX handler. The exploit exploits a two-phase validation failure: validate_file() only rejects literal '../' sequences, but the uwp_get_file_relative_url() helper later performs a global str_replace() that collapses crafted embedded tokens into directory traversal sequences after the final validation gate, with the result passed directly to wp_delete_file() without canonical containment. No public exploit code or CISA KEV listing is confirmed at time of analysis; however, the low privilege requirement and precise Wordfence source-level write-up substantially reduce the research barrier for threat actors.
Stored Cross-Site Scripting in the UsersWP WordPress plugin (all versions through 1.2.69) allows authenticated attackers with subscriber-level access to inject persistent JavaScript payloads via unsanitized variable substitution in the Badge Widget. The vulnerability stems from two distinct unsanitized code paths - the `uwp_get_user_badge()` function's `%%input%%` and `%%profile_url%%` template substitutions, and the `uwp_replace_variables()` function - both of which fail to apply `esc_html()` or `esc_url()` before rendering user-controlled values into page output. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Insecure Direct Object Reference in the UsersWP WordPress plugin (versions through 1.2.63) allows authenticated editor-level users to permanently delete or reset the avatar and banner images of any WordPress user account, including site administrators, by supplying an arbitrary user_id parameter. The vulnerability lies in missing authorization validation on the user_id key within image management handlers across class-forms.php, class-userswp.php, and class-profile.php, directly manipulating the uwp_usermeta table. No public exploit has been identified at time of analysis, and real-world severity is constrained by the high-privilege authentication prerequisite.
Blind Server-Side Request Forgery in UsersWP WordPress plugin versions up to 1.2.58 allows authenticated subscribers and above to force the WordPress server to make arbitrary HTTP requests via the uwp_crop parameter in avatar/banner image crop operations. The vulnerability stems from insufficient URL origin validation in the process_image_crop() method, which accepts user-controlled URLs and passes them to PHP image processing functions that support URL wrappers, enabling internal network reconnaissance and potential access to sensitive services. No public exploit code or active exploitation has been confirmed, though the vulnerability requires only authenticated access and low attack complexity.
Improper access control in UsersWP plugin for WordPress versions up to 1.2.58 allows authenticated subscribers and above to manipulate restricted user metadata fields via the upload_file_remove() AJAX handler, bypassing field-level permissions intended to restrict modifications to administrator-only fields. The vulnerability stems from insufficient validation of the $htmlvar parameter against allowed fields or admin-use restrictions, enabling attackers to clear or reset sensitive usermeta columns on their own user records.
Stored Cross-Site Scripting in UsersWP WordPress plugin up to version 1.2.60 allows authenticated subscribers and above to inject arbitrary JavaScript into user profile badge widgets via insufficiently sanitized URL fields, executing malicious scripts for all site visitors viewing affected pages. The vulnerability affects the badge widget rendering component due to improper output escaping in the wp-ayecode-ui library integration. No public exploit code or active exploitation has been identified, though the low attack complexity and subscriber-level access requirement make this a realistic threat in multi-user WordPress environments.