CVE-2026-120671 in UsersWP Plugin
Summary
by MITRE • 11/06/2026
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'badge' parameter in all versions up to, and including, 1.2.80 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is particularly effective against higher-privileged users — such as editors and administrators — who preview a Contributor's pending post containing the malicious shortcode.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/06/2026
The UsersWP plugin for WordPress, which provides front-end login forms, user registration capabilities, profile management, and member directory features, contains a critical security vulnerability in versions up to 1.2.80. This flaw is classified as a Stored Cross-Site Scripting (XSS) issue that stems from insufficient input sanitization and output escaping mechanisms within the application code. Specifically, the vulnerability resides in the handling of the badge parameter, which allows attackers to inject malicious JavaScript payloads into stored data structures on the server side rather than merely transient session data or URL parameters.
The technical nature of this flaw involves a failure to properly validate and escape user-supplied input before it is rendered back to other users within the WordPress environment. Because the injection point is associated with the badge parameter, an attacker can craft a request that stores malicious code in the database under the guise of legitimate profile or post metadata. When this data is subsequently retrieved and displayed on web pages without proper encoding, the browser interprets the embedded scripts as executable content, leading to the execution of arbitrary JavaScript within the context of the victim's session.
The operational impact of this vulnerability is significant due to its stored nature and the specific privilege levels required for exploitation. While the attack requires authentication with contributor-level access or higher, it becomes particularly dangerous when targeting users with elevated privileges such as editors or administrators. These high-privilege accounts often have broader capabilities within the WordPress dashboard, including content management and plugin configuration. If an editor or administrator previews a pending post authored by a compromised contributor account that contains the malicious shortcode associated with the badge parameter, their session is hijacked. This allows the attacker to execute actions on behalf of the privileged user, potentially leading to full site compromise, data exfiltration, defacement, or further lateral movement within the WordPress ecosystem.
From an industry standards perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The attack vector leverages stored persistence to maximize impact, fitting into MITRE ATT&CK technique T1059, specifically sub-techniques related to command and script interpretation via web browsers. The requirement for authenticated access classifies this under privilege escalation scenarios where lower-level users can leverage application logic flaws to affect higher-level accounts through social engineering or automated preview mechanisms inherent in content management workflows.
Mitigation strategies should focus on immediate remediation of the codebase alongside broader security hygiene practices. Users running versions 1.2.80 and below must update the plugin to the latest patched version released by the vendor, which addresses the sanitization and escaping deficiencies for the badge parameter. In cases where an upgrade is not immediately feasible, administrators should restrict contributor-level access to trusted individuals only and implement strict content review processes that do not rely on automatic previews of untrusted user-generated content without manual inspection. Additionally, deploying a Web Application Firewall with rules capable of detecting and blocking XSS payloads in POST requests can provide a layer of defense against exploitation attempts while the underlying code is being corrected. Regular security audits and adherence to secure coding standards such as OWASP guidelines for input validation are essential to prevent similar vulnerabilities from recurring in future updates or other plugins within the WordPress environment.