Stored Cross-Site Scripting in UsersWP Plugin for WordPress
CVE-2025-9344
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 28 August 2025
What is CVE-2025-9344?
The UsersWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping on user-supplied attributes within its 'uwp_profile' and 'uwp_profile_header' shortcodes. Authenticated attackers with contributor-level access can exploit this vulnerability to inject arbitrary web scripts, leading to potential unauthorized actions when users visit the compromised pages. This security risk threatens the integrity of user data and the overall security of affected WordPress sites.
Affected Version(s)
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP * <= 1.2.42