Log in Start free

stiofansisland

Products

ProductCVEsExploitedLatest
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP12–Oct 31, 2026
Payment forms, Buy now buttons, and Invoicing System | GetPaid2–Oct 17, 2026
Events Calendar for GeoDirectory1–Jun 9, 2026

Exploited and recent CVEs

  • CVE-2026-119980 Medium 6.5 UsersWP <= 1.2.78 - Unauthenticated Account Access via Predictable Dummy User Password Disclosed through Registration Form Hash 0.3%
  • CVE-2026-111110 High 7.2 Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' Parameter 0.3%
  • CVE-2026-19991 High 8.1 UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion 0.7%
  • CVE-2026-18501 Medium 6.4 UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution 0.3%
  • CVE-2026-17605 Medium 6.6 Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.56 - Authenticated (Administrator+) Local File Inclusion via Payment Form 'type' Element Field 1.2%
  • CVE-2026-13492 High 8.8 UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field 0.7%
  • CVE-2026-12102 Low 2.7 UsersWP <= 1.2.63 - Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user_id' Parameter 0.3%
  • CVE-2026-11616 High 8.8 Events Calendar for GeoDirectory <= 2.3.28 - Authenticated (Subscriber+) Privilege Escalation 0.3%
  • CVE-2026-4979 Medium 5.0 UsersWP <= 1.2.58 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter 0.4%
  • CVE-2026-4977 Medium 4.3 UsersWP <= 1.2.58 - Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter 0.3%
  • CVE-2026-5742 Medium 6.4 UsersWP <= 1.2.60 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link Substitution 0.2%
  • CVE-2025-10003 Medium 6.5 UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.44 - Authenticated (Subscriber+) SQL Injection 0.4%
  • CVE-2025-9344 Medium 6.4 UsersWP <= 1.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.2%
  • CVE-2024-6265 Critical 9.8 UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress <= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort_by' 2.4%
  • CVE-2024-2423 Medium 6.4 UsersWP <= 1.2.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode 0.4%