Stored Cross-Site Scripting Vulnerability in UsersWP Plugin by WordPress
CVE-2026-120671

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
UsersWP – Front-end Login Form, User Registration, User Profile & Members Directory Plugin For WP
Vendor
CVE Published:
6 November 2026

What is CVE-2026-120671?

The UsersWP plugin for WordPress has a vulnerability that allows authenticated users with contributor-level access and higher to exploit stored cross-site scripting via the 'badge' parameter. This occurs due to inadequate input sanitization and output escaping in all versions up to and including 1.2.80. Attackers can inject arbitrary web scripts that execute when other users access the compromised pages. Particularly at risk are higher-privileged users like editors and administrators, who may encounter malicious content in pending posts containing harmful shortcodes.

Affected Version(s)

UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP 0 <= 1.2.80

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/userswp/tags/1...
https://plugins.trac.wordpress.org/browser/userswp/tags/1...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.