Software intelligence
Important: Userswp appearing in this catalog does not mean your website is affected. Exposure depends on your installed version. How SiteRespond intelligence works
Tracked advisories
21
Latest advisory
6 August 2026
CISA KEV matches
0
In this WordPress feed
WordPress slug
userswp
Plugin
This catalog lists 21 known advisories affecting Userswp. The most recent was published on 6 August 2026. If you use this software, compare your installed version against the affected ranges on each advisory and update to a fixed release outside those ranges. SiteRespond Defence checks your actual installed version when the plugin is connected — listing here does not by itself mean your site is vulnerable.
UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution
May allow attackers to run scripts in visitors' browsers or hijack admin sessions.
Published 6 August 2026
UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field
May allow attackers to run arbitrary code on the server if exploited.
Published 9 July 2026
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP < 1.2.67 - Two-Factor Authentication Bypass
May allow access to accounts or admin areas without valid credentials.
Published 8 July 2026
Known Userswp advisories published by month.
CVE-2026-18501 · Published 6 August 2026
Affected versions: ≤ 1.2.69
CVE-2026-13492 · Published 9 July 2026
Affected versions: ≤ 1.2.65
CVE-2026-13690 · Published 8 July 2026
Affected versions: < 1.2.67
CVE-2026-12102 · Published 17 June 2026
Affected versions: ≤ 1.2.63
CVE-2026-4979 · Published 10 April 2026
Affected versions: ≤ 1.2.58
CVE-2026-4977 · Published 9 April 2026
Affected versions: ≤ 1.2.58
CVE-2026-5742 · Published 8 April 2026
Affected versions: ≤ 1.2.60
CVE-2026-25015 · Published 28 January 2026
Affected versions: ≤ 1.2.53
CVE-2025-67593 · Published 15 December 2025
Affected versions: ≤ 1.2.48
CVE-2025-66072 · Published 25 November 2025
Affected versions: ≤ 1.2.47
CVE-2025-10003 · Published 5 September 2025
Affected versions: ≤ 1.2.44
CVE-2025-9344 · Published 27 August 2025
Affected versions: ≤ 1.2.42
CVE-2024-43277 · Published 16 August 2024
Affected versions: ≤ 1.2.15
CVE-2024-6477 · Published 13 July 2024
Affected versions: ≤ 1.2.11
CVE-2024-6265 · Published 28 June 2024
Affected versions: ≤ 1.2.10
SiteRespond Defence matches your installed Userswp version against this catalog when the Defence plugin is connected to your WordPress site.