Plugin icon

UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP

userswp

Vulnerabilities:

16

Last Updated:

May 11, 2026

Active Installs:

20000

Published
Title
Fixed in
CVSS
Published
2026-04-10
Title
UsersWP < 1.2.59 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter
Fixed in
Fixed in 1.2.59
CVSS
5 (medium)
Published
2026-04-09
Title
UsersWP < 1.2.59 - Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter
Fixed in
Fixed in 1.2.59
CVSS
4.3 (medium)
Published
2026-04-08
Title
UsersWP < 1.2.61 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link Substitution
Fixed in
Fixed in 1.2.61
CVSS
6.4 (medium)
Published
2026-01-28
Title
UsersWP < 1.2.54 - Cross-Site Request Forgery
Fixed in
Fixed in 1.2.54
CVSS
4.3 (medium)
Published
2025-12-15
Title
UsersWP < 1.2.49 - Cross-Site Request Forgery
Fixed in
Fixed in 1.2.49
CVSS
4.3 (medium)
Published
2025-11-25
Title
UsersWP < 1.2.48 - Missing Authorization
Fixed in
Fixed in 1.2.48
CVSS
5.3 (medium)
Published
2025-09-05
Title
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP < 1.2.45 - Authenticated (Subscriber+) SQL Injection
Fixed in
Fixed in 1.2.45
CVSS
6.5 (medium)
Published
2025-08-27
Title
UsersWP < 1.2.43 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.2.43
CVSS
6.4 (medium)
Published
2024-08-16
Title
UsersWP < 1.2.16 - Missing Authorization
Fixed in
Fixed in 1.2.16
CVSS
5.3 (medium)
Published
2024-07-13
Title
UsersWP < 1.2.12 - Users Information Disclosure
Fixed in
Fixed in 1.2.12
CVSS
5.3 (medium)
Published
2024-06-28
Title
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress < 1.2.11 - Unauthenticated SQL Injection via 'uwp_sort_by'
Fixed in
Fixed in 1.2.11
CVSS
9.8 (critical)
Published
2024-04-10
Title
UsersWP < 1.2.6 - Cross-Site Request Forgery
Fixed in
Fixed in 1.2.6
CVSS
4.3 (medium)
Published
2024-03-14
Title
UsersWP < 1.2.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
Fixed in
Fixed in 1.2.7
CVSS
6.4 (medium)
Published
2023-11-01
Title
UsersWP < 1.2.3.23 - Profile Picture Deletion via CSRF
Fixed in
Fixed in 1.2.3.23
CVSS
4.3 (medium)
Published
2022-02-14
Title
UsersWP < 1.2.3.1 - Subscriber+ User Avatar Override
Fixed in
Fixed in 1.2.3.1
CVSS
4.3 (medium)
Published
2021-09-06
Title
UsersWP < 1.2.2.29 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.2.2.29
CVSS
4.7 (medium)