Description

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and including, 1.2.69 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-06T14:16:32.290Z",
  "pubdate": "2026-08-06T14:16:32.290Z",
  "executiveSummary": "An authenticated Stored Cross-Site Scripting (XSS) vulnerability exists in the UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress in all versions up to, and including, 1.2.69. The flaw arises from insufficient input sanitization and output escaping mechanisms within the Badge Widget Variable Substitution feature. This security deficiency allows authenticated attackers possessing subscriber-level access and above to inject arbitrary malicious web scripts into application pages. When targeted pages are subsequently accessed by other users, the injected payloads execute within the context of the victim's browser session. The risk implication includes potential session hijacking, unauthorized actions performed on behalf of other users, and defacement or redirection of affected pages. Exploitation requires authenticated access with subscriber privileges or higher, alongside user interaction when victims navigate to the injected pages.",
  "technicalDetails": "The vulnerability is classified as Stored Cross-Site Scripting (XSS), stemming from inadequate input sanitization and context-aware output escaping within the Badge Widget Variable Substitution component of the UsersWP plugin. Specifically, the software processes user-supplied input intended for badge variables without properly neutralizing executable markup or JavaScript constructs before persisting them to the database. When the stored variable data is subsequently rendered within the Badge Widget on front-end pages, the raw input is reflected directly into the Document Object Model (DOM) without proper sanitization or encoding. The attack flow commences with an authenticated attacker holding subscriber-level privileges or higher navigating to the administrative or profile interface where badge variables can be configured or manipulated. The attacker submits a crafted payload containing malicious JavaScript encapsulated within HTML tags or event handlers into the vulnerable input fields. The application accepts this input and stores it persistently within the database without stripping or encoding dangerous characters. Subsequently, when any user visits a page displaying the affected Badge Widget, the server retrieves the malicious payload from the database and embeds it into the HTTP response. The victim's web browser parses the response and executes the arbitrary script in the security context of the victim's active session. Because the vulnerability affects all versions up to and including 1.2.69, any deployment utilizing these vulnerable builds is susceptible. The execution of the script can lead to post-exploitation impacts such as session token theft, unauthorized modification of user profiles, privilege escalation if interacting with administrative endpoints, or the execution of arbitrary actions via the WordPress REST API or AJAX handlers."
}