CVE-2026-18501

Name of the Vulnerable Software and Affected Versions UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress versions prior to 1.2.70

Description Stored Cross-Site Scripting (XSS) occurs due to insufficient input sanitization and output escaping during Badge Widget Variable Substitution. This allows authenticated attackers with subscriber-level access or higher to inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

Recommendations Update the plugin to version 1.2.70 or later.