Vulnerabilities and security researches foruserswp userswp
Direction: descendingJun 19, 2026
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress # CVE-2026-12102
- CVE, Research URL
- Date
- Jun 18, 2026
- Research Description
- The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the 'user_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with editor-level access and above, to reset and permanently delete the avatar or banner image of any arbitrary user, including administrators, by clearing their avatar_thumb or banner_thumb metadata in the uwp_usermeta table.
- Affected versions
-
max 1.2.64.
- Status
-
vulnerable
Jun 16, 2026
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress # 55c172593544604071e103b6e01c42870b2ab4f4
- CVE, Research URL
- Date
- Dec 23, 2022
- Research Description
- UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP [userswp] < 1.2.3.10 WordPress UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress Plugin <= 1.2.3.9 is vulnerable to CSV Injection Update the WordPress UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin to the latest available version (at least 1.2.3.10). WordfenceTeam discovered and reported this CSV Injection vulnerability in WordPress UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress Plugin. This could allow a malicious actor to craft malicious formulas to then exploit vulnerabilities in the spreadsheet software or to execute commands to gain access to the victim';s PC. This vulnerability has been fixed in version 1.2.3.10.
- Affected versions
-
max 1.2.3.10.
- Status
-
vulnerable
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress # cd0a82b3704ec676b4453be7616ae7f5da2543b3
- CVE, Research URL
- Date
- Dec 21, 2022
- Research Description
- UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP [userswp] < 1.2.3.10 UsersWP <= 1.2.3.9 - Authenticated (Administrator+) CSV Injection The UsersWP plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.2.3.9 via the process_users_export function. This allows administrator-level attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
- Affected versions
-
max 1.2.3.10.
- Status
-
vulnerable
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress # d0434659-4e25-4b2b-872f-29a9055e5dab
- CVE, Research URL
- Date
- -
- Research Description
- UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP [userswp] < 1.2.2.29 wpscan.com
- Affected versions
-
max 1.2.2.29.
- Status
-
vulnerable
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress # b85160e4ac30c382429b5eb8a9a4a58235cd4a60
- CVE, Research URL
- Date
- Sep 06, 2021
- Research Description
- UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP [userswp] < 1.2.2.29 UsersWP – User Registration & User Profile <= 1.2.2.28 - Reflected Cross-Site Scripting The UsersWP – User Registration & User Profile plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters in versions up to, and including, 1.2.2.28 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Affected versions
-
max 1.2.2.29.
- Status
-
vulnerable
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress # 64931f1b9e520690cdca9ff2ec0ef1210f84ae48
- CVE, Research URL
- Date
- Nov 01, 2023
- Research Description
- UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP [userswp] < 1.2.3.23 UsersWP <= 1.2.3.22 - Cross-Site Request Forgery The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to 1.2.3.23 (exclusive). This is due to missing or incorrect nonce validation on the ajax_profile_image_remove function. This makes it possible for unauthenticated attackers to delete user images via a forged request granted they can trick a site user into performing an action such as clicking on a link.
- Affected versions
-
max 1.2.3.23.
- Status
-
vulnerable
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress # c2912faa-ce49-4146-8ee6-b03e29ca9db7
- CVE, Research URL
- Date
- -
- Research Description
- UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP [userswp] < 1.2.3.23 UsersWP < 1.2.3.23 - Profile Picture Deletion via CSRF The plugin does not have CSRF check when deleting profile pictures, which could allow attackers to make logged in users perform unwanted actions via a CSRF attack
- Affected versions
-
max 1.2.3.23.
- Status
-
vulnerable
Jun 13, 2026
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress # CVE-2025-67593
- CVE, Research URL
- Date
- Dec 09, 2025
- Research Description
- Cross-Site Request Forgery (CSRF) vulnerability in Stiofan UsersWP userswp allows Cross Site Request Forgery.This issue affects UsersWP: from n/a through <= 1.2.48.
- Affected versions
-
max 1.2.49.
- Status
-
vulnerable
Apr 13, 2026
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress # CVE-2026-4979
- CVE, Research URL
- Date
- Apr 11, 2026
- Research Description
- The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to blind Server-Side Request Forgery in all versions up to, and including, 1.2.58. This is due to insufficient URL origin validation in the process_image_crop() method when processing avatar/banner image crop operations. The function accepts a user-controlled URL via the uwp_crop POST parameter and only validates it using esc_url() for sanitization and wp_check_filetype() for extension verification, without enforcing that the URL references a local uploads file. The URL is then passed to uwp_resizeThumbnailImage() which uses it in PHP image processing functions (getimagesize(), imagecreatefrom*()) that support URL wrappers and perform outbound HTTP requests. This makes it possible for authenticated attackers with subscriber-level access and above to coerce the WordPress server into making arbitrary HTTP requests to attacker-controlled or internal network destinations, enabling internal network scanning and potential access to sensitive services.
- Affected versions
-
max 1.2.59.
- Status
-
vulnerable
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress # CVE-2026-5742
- CVE, Research URL
- Date
- Apr 09, 2026
- Research Description
- The UsersWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.2.60. This is due to insufficient input sanitization of user-supplied URL fields and improper output escaping when rendering user profile data in badge widgets. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts that will execute whenever a user accesses a page containing the affected badge widget.
- Affected versions
-
max 1.2.61.
- Status
-
vulnerable
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress # CVE-2026-4977
- CVE, Research URL
- Date
- Apr 10, 2026
- Research Description
- The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to Improper Access Control in all versions up to, and including, 1.2.58 This is due to insufficient field-level permission validation in the upload_file_remove() AJAX handler where the $htmlvar parameter is not validated against a whitelist of allowed fields or checked against the field's for_admin_use property. This makes it possible for authenticated attackers, with subscriber-level access and above, to clear or reset any restricted usermeta column for their own user record, including fields marked as "For admin use only", bypassing intended field-level access restrictions.
- Affected versions
-
max 1.2.59.
- Status
-
vulnerable
Feb 27, 2026
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress # CVE-2026-25015
- CVE, Research URL
- Date
- Feb 03, 2026
- Research Description
- Cross-Site Request Forgery (CSRF) vulnerability in Stiofan UsersWP userswp allows Cross Site Request Forgery.This issue affects UsersWP: from n/a through <= 1.2.53.
- Affected versions
-
max 1.2.54.
- Status
-
vulnerable
Dec 11, 2025
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress # CVE-2025-66072
- CVE, Research URL
- Date
- Nov 21, 2025
- Research Description
- Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through <= 1.2.47.
- Affected versions
-
max 1.2.48.
- Status
-
vulnerable
Sep 07, 2025
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress # CVE-2025-10003
- CVE, Research URL
- Date
- Sep 06, 2025
- Research Description
- The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘upload_file_remove’ function and 'htmlvar' parameter in all versions up to, and including, 1.2.44 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Affected versions
-
max 1.2.45.
- Status
-
vulnerable
Aug 28, 2025
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress # CVE-2025-9344
- CVE, Research URL
- Date
- Aug 28, 2025
- Research Description
- The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'uwp_profile' and 'uwp_profile_header' shortcodes in all versions up to, and including, 1.2.42 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
max 1.2.43.
- Status
-
vulnerable
Aug 20, 2024
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress # CVE-2024-43277
- CVE, Research URL
- Date
- Nov 01, 2024
- Research Description
- Missing Authorization vulnerability in AyeCode Ltd UsersWP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.15.
- Affected versions
-
max 1.2.16.
- Status
-
vulnerable
Aug 04, 2024
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress # CVE-2024-6477
- CVE, Research URL
- Date
- Aug 03, 2024
- Research Description
- The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could allow unauthenticated attackers to download them and retrieve sensitive information such as IP, username, and email address
- Affected versions
-
max 1.2.12.
- Status
-
vulnerable
Jun 30, 2024
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress # CVE-2024-6265
- CVE, Research URL
- Date
- Jun 29, 2024
- Research Description
- The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uwp_sort_by’ parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Affected versions
-
max 1.2.11.
- Status
-
vulnerable
Jun 06, 2024
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress # CVE-2022-0442
- CVE, Research URL
- Date
- Mar 07, 2022
- Research Description
- The UsersWP WordPress plugin before 1.2.3.1 is missing access controls when updating a user avatar, and does not make sure file names for user avatars are unique, allowing a logged in user to overwrite another users avatar.
- Affected versions
-
max 1.2.3.1.
- Status
-
vulnerable
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress # CVE-2022-47442
- CVE, Research URL
- Date
- Nov 07, 2023
- Research Description
- Improper Neutralization of Formula Elements in a CSV File vulnerability in AyeCode Ltd UsersWP.This issue affects UsersWP: from n/a through 1.2.3.9.
- Affected versions
-
max 1.2.3.10.
- Status
-
vulnerable
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress # CVE-2024-2423
- CVE, Research URL
- Date
- Apr 10, 2024
- Research Description
- The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
max 1.2.7.
- Status
-
vulnerable
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress # CVE-2024-31936
- CVE, Research URL
- Date
- Apr 11, 2024
- Research Description
- Cross-Site Request Forgery (CSRF) vulnerability in AyeCode Ltd UsersWP.This issue affects UsersWP: from n/a before 1.2.6.
- Affected versions
-
max 1.2.6.
- Status
-
vulnerable