All products
userswp
WordPress · Plugin26 reports| Report | Product | Ecosystem | Severity | Fix status | Last updated |
|---|
| UsersWP <= 1.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'badge' Shortcode AttributeCVE-2026-120671 |
userswp |
WordPress |
Medium
|
Fix reported |
|
| UsersWP <= 1.2.78 - Unauthenticated Account Access via Predictable Dummy User Password Disclosed through Registration Form HashCVE-2026-119980 |
userswp |
WordPress |
Medium
|
Fix reported |
|
| UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.73 - Unauthenticated Stored Cross-Site ScriptingCVE-2026-94641 |
userswp |
WordPress |
High
|
Fix reported |
|
| UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.74 - Missing AuthorizationCVE-2026-103086 |
userswp |
WordPress |
Medium
|
Fix reported |
|
| UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File DeletionCVE-2026-19991 |
userswp |
WordPress |
High
|
Fix reported |
|
| UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable SubstitutionCVE-2026-18501 |
userswp |
WordPress |
Medium
|
Fix reported |
|
| UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP < 1.2.67 - Two-Factor Authentication BypassCVE-2026-13690 |
userswp |
WordPress |
Medium
|
Fix reported |
|
| UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload FieldCVE-2026-13492 |
userswp |
WordPress |
High
|
Fix reported |
|
| UsersWP <= 1.2.63 - Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user_id' ParameterCVE-2026-12102 |
userswp |
WordPress |
Low
|
Fix reported |
|
| UsersWP <= 1.2.58 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' ParameterCVE-2026-4979 |
userswp |
WordPress |
Medium
|
Fix reported |
|
| UsersWP <= 1.2.58 - Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' ParameterCVE-2026-4977 |
userswp |
WordPress |
Medium
|
Fix reported |
|
| UsersWP <= 1.2.60 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link SubstitutionCVE-2026-5742 |
userswp |
WordPress |
Medium
|
Fix reported |
|
| UsersWP <= 1.2.53 - Cross-Site Request ForgeryCVE-2026-25015 |
userswp |
WordPress |
Medium
|
Fix reported |
|
| UsersWP <= 1.2.48 - Cross-Site Request ForgeryCVE-2025-67593 |
userswp |
WordPress |
Medium
|
Fix reported |
|
| UsersWP <= 1.2.47 - Missing AuthorizationCVE-2025-66072 |
userswp |
WordPress |
Medium
|
Fix reported |
|
| UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.44 - Authenticated (Subscriber+) SQL InjectionCVE-2025-10003 |
userswp |
WordPress |
Medium
|
Fix reported |
|
| UsersWP <= 1.2.42 - Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2025-9344 |
userswp |
WordPress |
Medium
|
Fix reported |
|
| UsersWP <= 1.2.15 - Missing AuthorizationCVE-2024-43277 |
userswp |
WordPress |
Medium
|
Fix reported |
|
| UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.11 - Unauthenticated Information Disclosure via Unprotected DirectoriesCVE-2024-6477 |
userswp |
WordPress |
Medium
|
Fix reported |
|
| UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress <= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort_by'CVE-2024-6265 |
userswp |
WordPress |
Critical
|
Fix reported |
|
