CVE-2026-5742

Description

The UsersWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.2.60. This is due to insufficient input sanitization of user-supplied URL fields and improper output escaping when rendering user profile data in badge widgets. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts that will execute whenever a user accesses a page containing the affected badge widget.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected products

stiofansisland / UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP0 – 1.2.60

References

MISChttps://www.wordfence.com/threat-intel/vulnerabilities/id/bdb619c5-967c-4b8c-8a93-bcdb49137d56?source=cve
MISChttps://plugins.trac.wordpress.org/browser/userswp/trunk/vendor/ayecode/wp-ayecode-ui/includes/components/class-aui-component-button.php#L53
MISChttps://plugins.trac.wordpress.org/browser/userswp/tags/1.2.55/vendor/ayecode/wp-ayecode-ui/includes/components/class-aui-component-button.php#L53
MISChttps://plugins.trac.wordpress.org/browser/userswp/trunk/includes/helpers/pages.php#L392-L540
MISChttps://plugins.trac.wordpress.org/browser/userswp/tags/1.2.55/includes/helpers/pages.php#L392-L540
MISChttps://plugins.trac.wordpress.org/browser/userswp/trunk/includes/helpers/pages.php#L522-L527
MISChttps://plugins.trac.wordpress.org/browser/userswp/tags/1.2.55/includes/helpers/pages.php#L522-L527
MISChttps://plugins.trac.wordpress.org/browser/userswp/trunk/includes/class-forms.php#L1963
MISChttps://plugins.trac.wordpress.org/browser/userswp/tags/1.2.55/includes/class-forms.php#L1963
MISChttps://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3501691%40userswp&new=3501691%40userswp&sfp_email=&sfph_mail=