UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP

Information

Software Type Plugin
Software Slug userswp (view on wordpress.org)
Software Status Active
Software Author stiofansisland
Software Website userswp.io
Software Downloads 1,439,479
Software Active Installs 20,000
Software Record Last Updated October 13, 2026

Showing 1-20 of 24 Vulnerabilities

Submit a Vulnerability
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.74 - Missing Authorization
4.3
CVE-2026-103086
Oct 3, 2026
Researcher: Md. Moniruzzaman Prodhan
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.73 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-94641
Oct 3, 2026
Researcher: Mor Golan
UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion
8.1
CVE-2026-19991
Sep 10, 2026
Researcher: daroo
UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution
6.4
CVE-2026-18501
Aug 6, 2026
Researcher: Jonah Burgess (CryptoCat)
UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field
8.8
CVE-2026-13492
Jul 9, 2026
Researcher: daroo
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP < 1.2.67 - Two-Factor Authentication Bypass
5.3
CVE-2026-13690
Jul 8, 2026
Researcher: dc11
UsersWP <= 1.2.63 - Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user_id' Parameter
2.7
CVE-2026-12102
Jun 17, 2026
Researcher: Pasindu Dilshan (K4PXD)
UsersWP <= 1.2.58 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter
5.0
CVE-2026-4979
Apr 10, 2026
Researcher: s00me00ne
UsersWP <= 1.2.58 - Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter
4.3
CVE-2026-4977
Apr 9, 2026
Researcher: nquangit
UsersWP <= 1.2.60 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link Substitution
6.4
CVE-2026-5742
Apr 8, 2026
Researcher: Osvaldo Noe Gonzalez Del Rio (Os)
UsersWP <= 1.2.53 - Cross-Site Request Forgery
4.3
CVE-2026-25015
Jan 28, 2026
Researcher: Tristan Jay Neale
UsersWP <= 1.2.48 - Cross-Site Request Forgery
4.3
CVE-2025-67593
Dec 15, 2025
Researcher: daroo
UsersWP <= 1.2.47 - Missing Authorization
5.3
CVE-2025-66072
Nov 25, 2025
Researcher: Legion Hunter
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.44 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2025-10003
Sep 5, 2025
Researcher: Nguyen Ngoc Quang Bach (maysbachs)
UsersWP <= 1.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-9344
Aug 27, 2025
Researcher: stealthcopter
UsersWP <= 1.2.15 - Missing Authorization
5.3
CVE-2024-43277
Aug 16, 2024
Researcher: Ananda Dhakal
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.11 - Unauthenticated Information Disclosure via Unprotected Directories
5.3
CVE-2024-6477
Jul 13, 2024
Researcher: Majdeddine Ben Hadj Brahim
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress <= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort_by'
9.8
CVE-2024-6265
Jun 28, 2024
Researcher: Trương Hữu Phúc (truonghuuphuc)
UsersWP <= 1.2.4 - Cross-Site Request Forgery
4.3
CVE-2024-31936
Apr 10, 2024
Researcher: Brandon James Roldan (tomorrowisnew)
UsersWP <= 1.2.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2024-2423
Mar 14, 2024
Researcher: Krzysztof Zając
Title Status CVE ID CVSS Researchers Date
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.74 - Missing Authorization Patched CVE-2026-103086 4.3 Md. Moniruzzaman Prodhan October 3, 2026
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.73 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2026-94641 7.2 Mor Golan October 3, 2026
UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion Patched CVE-2026-19991 8.1 daroo September 10, 2026
UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution Patched CVE-2026-18501 6.4 Jonah Burgess (CryptoCat) August 6, 2026
UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field Patched CVE-2026-13492 8.8 daroo July 9, 2026
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP < 1.2.67 - Two-Factor Authentication Bypass Patched CVE-2026-13690 5.3 dc11 July 8, 2026
UsersWP <= 1.2.63 - Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user_id' Parameter Patched CVE-2026-12102 2.7 Pasindu Dilshan (K4PXD) June 17, 2026
UsersWP <= 1.2.58 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter Patched CVE-2026-4979 5.0 s00me00ne April 10, 2026
UsersWP <= 1.2.58 - Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter Patched CVE-2026-4977 4.3 nquangit April 9, 2026
UsersWP <= 1.2.60 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link Substitution Patched CVE-2026-5742 6.4 Osvaldo Noe Gonzalez Del Rio (Os) April 8, 2026
UsersWP <= 1.2.53 - Cross-Site Request Forgery Patched CVE-2026-25015 4.3 Tristan Jay Neale January 28, 2026
UsersWP <= 1.2.48 - Cross-Site Request Forgery Patched CVE-2025-67593 4.3 daroo December 15, 2025
UsersWP <= 1.2.47 - Missing Authorization Patched CVE-2025-66072 5.3 Legion Hunter November 25, 2025
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.44 - Authenticated (Subscriber+) SQL Injection Patched CVE-2025-10003 6.5 Nguyen Ngoc Quang Bach (maysbachs) September 5, 2025
UsersWP <= 1.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2025-9344 6.4 stealthcopter August 27, 2025
UsersWP <= 1.2.15 - Missing Authorization Patched CVE-2024-43277 5.3 Ananda Dhakal August 16, 2024
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.11 - Unauthenticated Information Disclosure via Unprotected Directories Patched CVE-2024-6477 5.3 Majdeddine Ben Hadj Brahim July 13, 2024
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress <= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort_by' Patched CVE-2024-6265 9.8 Trương Hữu Phúc (truonghuuphuc) June 28, 2024
UsersWP <= 1.2.4 - Cross-Site Request Forgery Patched CVE-2024-31936 4.3 Brandon James Roldan (tomorrowisnew) April 10, 2024
UsersWP <= 1.2.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode Patched CVE-2024-2423 6.4 Krzysztof Zając March 14, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation