CVE-2026-120671

Name of the Vulnerable Software and Affected Versions UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress versions prior to 1.2.81

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts via the badge parameter. These scripts execute when a user accesses the affected page, specifically targeting higher-privileged users like editors and administrators who preview pending posts containing the malicious shortcode.

Recommendations Update the plugin to version 1.2.81 or later.