WordPress plugin
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 26 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High3
- Medium21
- Low1
All UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP vulnerabilities
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'badge' Shortcode Attribute
≤1.2.80Update to 1.2.81
- Medium6.5Unauthenticated Account Access via Predictable Dummy User Password Disclosed through Registration Form Hash
≤1.2.78Update to 1.2.79
- Medium4.3Missing Authorization
≤1.2.74Update to 1.2.76
- High7.2Unauthenticated Stored Cross-Site Scripting
≤1.2.73Update to 1.2.74
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
≤1.2.70Update to 1.2.71
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution
≤1.2.69Update to 1.2.70
- High8.8Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field
≤1.2.65Update to 1.2.66
- Medium5.3Two-Factor Authentication Bypass
<1.2.67Update to 1.2.67
- Low2.7Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user_id' Parameter
≤1.2.63Update to 1.2.64
- Medium5.0Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter
≤1.2.58Update to 1.2.59
- Medium4.3Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter
≤1.2.58Update to 1.2.59
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link Substitution
≤1.2.60Update to 1.2.61
- Medium4.3Cross-Site Request Forgery
≤1.2.53Update to 1.2.54
- Medium4.3Cross-Site Request Forgery
≤1.2.48Update to 1.2.49
- Medium5.3Missing Authorization
≤1.2.47Update to 1.2.48
- Medium6.5Authenticated (Subscriber+) SQL Injection
≤1.2.44Update to 1.2.45
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.2.42Update to 1.2.43
- Medium5.3Missing Authorization
≤1.2.15Update to 1.2.16
- Medium5.3Unauthenticated Information Disclosure via Unprotected Directories
≤1.2.11Update to 1.2.12
- Critical9.8Unauthenticated SQL Injection via 'uwp_sort_by'
≤1.2.10Update to 1.2.11
- Medium4.3Cross-Site Request Forgery
≤1.2.4Update to 1.2.6
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
≤1.2.6Update to 1.2.7
- Medium4.3Cross-Site Request Forgery
<1.2.3.23Update to 1.2.3.23
- Medium5.5Authenticated (Administrator+) CSV Injection
≤1.2.3.9Update to 1.2.3.10
- Medium4.3Subscriber+ User Avatar Override
<1.2.3.1Update to 1.2.3.1
- Medium6.1Reflected Cross-Site Scripting
≤1.2.2.28Update to 1.2.2.29
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP: common questions
Does UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP have known vulnerabilities?
Yes. VulnCrest Radar lists 26 known vulnerabilities in UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP: 1 critical, 3 high, 21 medium, 1 low. None are known to affect version null.
How do I check which version of UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP vulnerability?
CVE-2026-120671, published Nov 5, 2026: UsersWP <= 1.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'badge' Shortcode Attribute. Severity: Medium (CVSS 6.4).
Is any UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP vulnerability listed in CISA KEV?
No. None of the known UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP vulnerabilities is currently listed in the CISA KEV catalog.