Description

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'badge' parameter in all versions up to, and including, 1.2.80 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is particularly effective against higher-privileged users — such as editors and administrators — who preview a Contributor's pending post containing the malicious shortcode.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-11-06T09:17:00.483Z",
  "pubdate": "2026-11-06T09:17:00.483Z",
  "executiveSummary": "The UsersWP WordPress plugin (versions 1.2.80 and earlier) contains a critical Stored Cross-Site Scripting (XSS) vulnerability via the 'badge' parameter.\nThis vulnerability stems from inadequate input sanitization and output escaping of user-supplied data, allowing authenticated attackers with contributor-level privileges or higher to inject arbitrary malicious JavaScript into the application.\nThe flaw poses a significant risk to the integrity and security of the WordPress installation, as injected scripts execute within the browser context of any user viewing the affected content, including administrators and editors.\nSuccessful exploitation allows attackers to hijack user sessions, perform unauthorized administrative actions, redirect users, or exfiltrate sensitive data, such as authentication cookies or nonces, potentially leading to a full site compromise.\nThe attack vector is particularly potent as it targets privileged users reviewing content, effectively bridging the gap between low-privileged accounts and high-privileged administrative access.\nRemediation requires upgrading the plugin to a version where these input and output handling issues have been addressed by the developers.",
  "technicalDetails": "The vulnerability resides in the handling of the 'badge' parameter within the UsersWP plugin, specifically affecting versions 1.2.80 and below. The root cause is a failure to implement robust input validation or context-aware output encoding when processing user-defined badge data.\nIn WordPress, Stored XSS occurs when user-supplied input is saved to the database without proper sanitization and later rendered on a page without appropriate escaping. In the context of UsersWP, the 'badge' parameter serves as an injection vector. When an attacker, possessing at least Contributor-level privileges, creates or edits a post or profile element, they can inject malicious JavaScript payloads directly into the 'badge' parameter field.\nThe attack flow proceeds as follows: First, the authenticated attacker crafts a payload (e.g., <script>alert('XSS')</script> or more complex obfuscated JavaScript) and supplies it through the vulnerable 'badge' parameter. Because the plugin does not properly sanitize this input, the payload is stored directly into the WordPress database.\nThe secondary phase of the attack is triggered when a high-privileged user, such as an administrator or editor, accesses a page where the malicious content is rendered—most notably when reviewing pending posts created by the contributor. As the victim's browser loads the page, the server returns the stored malicious script, and the victim's browser executes it in the security context of the site.\nBecause the script executes in the browser of an administrator or editor, the payload can perform actions on their behalf. These actions include, but are not limited to, modifying site settings, creating new administrator-level user accounts, exfiltrating anti-CSRF tokens (nonces), or redirecting the user to malicious external sites. Since the payload is stored, it will continue to execute every time a user views the compromised page until the data is manually removed from the database or the plugin is updated to include proper sanitization routines.\nThe vulnerability is effectively a failure in the plugin's data lifecycle management, where the trust boundary between stored input and rendered output is not maintained. By failing to use WordPress core functions such as sanitize_text_field() during input and esc_html() or esc_attr() during output, the plugin exposes the host application to arbitrary script injection."
}