stiofansisland UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP

• CVE-2026-119980 Medium 6.5 UsersWP <= 1.2.78 - Unauthenticated Account Access via Predictable Dummy User Password Disclosed through Registration Form Hash 0.3%
• CVE-2026-19991 High 8.1 UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion 0.7%
• CVE-2026-18501 Medium 6.4 UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution 0.3%
• CVE-2026-13492 High 8.8 UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field 0.7%
• CVE-2026-12102 Low 2.7 UsersWP <= 1.2.63 - Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user_id' Parameter 0.3%
• CVE-2026-4979 Medium 5.0 UsersWP <= 1.2.58 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter 0.4%
• CVE-2026-4977 Medium 4.3 UsersWP <= 1.2.58 - Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter 0.3%
• CVE-2026-5742 Medium 6.4 UsersWP <= 1.2.60 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link Substitution 0.2%
• CVE-2025-10003 Medium 6.5 UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.44 - Authenticated (Subscriber+) SQL Injection 0.4%
• CVE-2025-9344 Medium 6.4 UsersWP <= 1.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.2%
• CVE-2024-6265 Critical 9.8 UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress <= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort_by' 2.4%
• CVE-2024-2423 Medium 6.4 UsersWP <= 1.2.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode 0.4%