HomeWordPress vulnerabilitiesUsersWP
UsersWP vulnerabilities
UsersWP has 16 known vulnerabilities in this database. The most recent published record is dated 5 Oct 2026.
- Known vulnerabilities
- 16
- Active installs
- 20,000+
- Latest version
- 1.2.76
- Last updated
- 30 Sep 2026
- Most recent
- 5 Oct 2026
Find it in your WordPress dashboard under Plugins. Severity is based on the CVSS score published with the CVE where one is available.
| Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|
| Broken access control CVE-2026-103086 | Medium 6.5 | Up to 1.2.74 | Fixed in a later version (latest 1.2.76) | 2 d ago |
| Privilege escalation CVE-2026-86814 | High 8.1 | Before 1.5.10 | Fixed in 1.5.10 | 19 Sep 2026 |
| Arbitrary file deletion CVE-2026-19991 | High 8.1 | Up to 1.2.70 | Fixed in a later version (latest 1.2.76) | 11 Sep 2026 |
| Cross-site scripting (XSS) CVE-2026-18501 | Medium 6.4 | Up to 1.2.69 | Fixed in a later version (latest 1.2.76) | 6 Aug 2026 |
| Authentication bypass CVE-2026-13690 | High 7.4 | Before 1.2.67 | Fixed in 1.2.67 | 29 Jul 2026 |
| Arbitrary file deletion CVE-2026-13492 | High 8.8 | Up to 1.2.65 | Fixed in a later version (latest 1.2.76) | 9 Jul 2026 |
| Broken access control CVE-2026-12102 | Low 2.7 | Up to 1.2.63 | Fixed in a later version (latest 1.2.76) | 18 Jun 2026 |
| Server-side request forgery (SSRF) CVE-2026-4979 | Medium 5.0 | Up to 1.2.58 | Fixed in a later version (latest 1.2.76) | 11 Apr 2026 |
| Broken access control CVE-2026-4977 | Medium 4.3 | Up to 1.2.58 | Fixed in a later version (latest 1.2.76) | 10 Apr 2026 |
| Cross-site scripting (XSS) CVE-2026-5742 | Medium 6.4 | Up to 1.2.60 | Fixed in a later version (latest 1.2.76) | 9 Apr 2026 |
| SQL injection CVE-2025-10003 | Medium 6.5 | Up to 1.2.44 | Fixed in a later version (latest 1.2.76) | 6 Sep 2025 |
| Cross-site scripting (XSS) CVE-2025-9344 | Medium 6.4 | Up to 1.2.42 | Fixed in a later version (latest 1.2.76) | 28 Aug 2025 |
| Security weakness CVE-2024-6477 | High 7.5 | Before 1.2.12 | Fixed in 1.2.12 | 3 Aug 2024 |
| SQL injection CVE-2024-6265 | Critical 9.8 | Before 1.2.11 | Fixed in 1.2.11 | 29 Jun 2024 |
| Cross-site scripting (XSS) CVE-2024-2423 | Medium 6.4 | Before 1.2.7 | Fixed in 1.2.7 | 9 Apr 2024 |
| Broken access control CVE-2022-0442 | Medium 4.3 | Before 1.2.3.1 | Fixed in 1.2.3.1 | 7 Mar 2022 |
Read the published descriptions
- CVE-2026-103086, 5 Oct 2026
- Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.74. CVE record
- CVE-2026-86814, 19 Sep 2026
- The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can assert through a provider account of their own. CVE record
- CVE-2026-19991, 11 Sep 2026
- The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the upload_file_remove() AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $_POST when no real $_FILES upload is provided (process_account() calls uwp_validate_fields() and array_merges the result with the empty output of UsersWP_Files::validate_uploads()). At storage time the value is only checked with validate_file(), which passes any string that does not contain a literal '../'. When the value is later processed by upload_file_remove(), it is again gated with validate_file() and then normalized through uwp_get_file_relative_url(); that helper performs a global str_replace() of the uploads base URL against the stored URL, allowing a crafted URL containing embedded '..<uploads-baseurl>' tokens to collapse into '../../' traversal sequences after the last validation. The transformed value is then appended to the uploads base directory and passed to wp_delete_file() without any canonical containment check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the affected site's server (including wp-config. CVE record
- CVE-2026-18501, 6 Aug 2026
- The UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and including, 1.2.69 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2026-13690, 29 Jul 2026
- The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user. CVE record
- CVE-2026-13492, 9 Jul 2026
- The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.65. This is due to insufficient validation of file-field values in the UsersWP_Validation::validate_fields() function (which falls through to sanitize_text_field() for fields of type 'file', leaving directory-traversal sequences intact) combined with the UsersWP_Forms::upload_file_remove() AJAX handler building the deletion target from the uploads basedir concatenated with the attacker-controlled metadata value without any realpath canonicalization or uploads-directory boundary check before calling unlink(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the affected site's server, including wp-config. CVE record
- CVE-2026-12102, 18 Jun 2026
- The UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the 'user_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with editor-level access and above, to reset and permanently delete the avatar or banner image of any arbitrary user, including administrators, by clearing their avatar_thumb or banner_thumb metadata in the uwp_usermeta table. CVE record
- CVE-2026-4979, 11 Apr 2026
- The UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to blind Server-Side Request Forgery in all versions up to, and including, 1.2.58. This is due to insufficient URL origin validation in the process_image_crop() method when processing avatar/banner image crop operations. The function accepts a user-controlled URL via the uwp_crop POST parameter and only validates it using esc_url() for sanitization and wp_check_filetype() for extension verification, without enforcing that the URL references a local uploads file. The URL is then passed to uwp_resizeThumbnailImage() which uses it in PHP image processing functions (getimagesize(), imagecreatefrom*()) that support URL wrappers and perform outbound HTTP requests. This makes it possible for authenticated attackers with subscriber-level access and above to coerce the WordPress server into making arbitrary HTTP requests to attacker-controlled or internal network destinations, enabling internal network scanning and potential access to sensitive services. CVE record
- CVE-2026-4977, 10 Apr 2026
- The UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to Improper Access Control in all versions up to, and including, 1.2.58 This is due to insufficient field-level permission validation in the upload_file_remove() AJAX handler where the $htmlvar parameter is not validated against a whitelist of allowed fields or checked against the field's for_admin_use property. This makes it possible for authenticated attackers, with subscriber-level access and above, to clear or reset any restricted usermeta column for their own user record, including fields marked as "For admin use only", bypassing intended field-level access restrictions. CVE record
- CVE-2026-5742, 9 Apr 2026
- The UsersWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.2.60. This is due to insufficient input sanitization of user-supplied URL fields and improper output escaping when rendering user profile data in badge widgets. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts that will execute whenever a user accesses a page containing the affected badge widget. CVE record
- CVE-2025-10003, 6 Sep 2025
- The UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘upload_file_remove’ function and 'htmlvar' parameter in all versions up to, and including, 1.2.44 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE record
- CVE-2025-9344, 28 Aug 2025
- The UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'uwp_profile' and 'uwp_profile_header' shortcodes in all versions up to, and including, 1.2.42 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2024-6477, 3 Aug 2024
- The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could allow unauthenticated attackers to download them and retrieve sensitive information such as IP, username, and email address CVE record
- CVE-2024-6265, 29 Jun 2024
- The UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uwp_sort_by’ parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE record
- CVE-2024-2423, 9 Apr 2024
- The UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2022-0442, 7 Mar 2022
- The UsersWP WordPress plugin before 1.2.3.1 is missing access controls when updating a user avatar, and does not make sure file names for user avatars are unique, allowing a logged in user to overwrite another users avatar. CVE record
What to do if you run UsersWP
If you run UsersWP, open WordPress and check the installed version in Plugins. Compare it with the affected versions in the vulnerability record. If a fixed version is available, take a current backup and update to that version or the latest supported release.
If no fixed version exists, consider disabling and removing the plugin or replacing it with a maintained alternative. After dealing with the affected software, check administrator users, unexpected file changes, redirects, unfamiliar pages and security logs for signs that the site may already have been altered.
Email me about new UsersWP vulnerabilities
Free. We email you when a new vulnerability is published for UsersWP, usually within minutes. Confirm by email; unsubscribe any time.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.