CVE-2026-18501 in UsersWP Plugin
Summary
by MITRE • 08/06/2026
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and including, 1.2.69 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/06/2026
The UsersWP plugin for WordPress presents a critical stored cross-site scripting vulnerability that affects versions up to and including 1.2.69. This vulnerability resides within the Badge Widget functionality where variable substitution occurs without proper sanitization or output escaping mechanisms. The flaw enables authenticated attackers who possess subscriber-level privileges or higher to execute malicious code through crafted input that gets stored in the application's database. The vulnerability manifests when user-generated content containing malicious scripts is processed and displayed within the badge widget context, creating a persistent threat vector that can affect any user who accesses pages containing the compromised content.
The technical exploitation of this vulnerability follows a well-established pattern that aligns with CWE-79 - Improper Neutralization of Input During Web Page Generation. Attackers can leverage their subscriber-level access to inject malicious JavaScript payloads through the badge widget interface, which then gets stored and executed whenever other users view pages containing the compromised badge elements. The root cause stems from inadequate input validation processes that fail to properly sanitize user-supplied data before it is rendered in web page contexts. This represents a classic case of insufficient output escaping where dynamic content substitution occurs without proper HTML entity encoding or script context sanitization, allowing attackers to inject executable code that operates within the security context of affected users.
The operational impact of this vulnerability extends beyond simple script execution as it creates persistent attack vectors that can be leveraged for various malicious purposes including session hijacking, credential theft, and data exfiltration. An authenticated attacker with subscriber privileges can inject scripts that monitor user interactions, capture form submissions, or redirect victims to malicious domains. The stored nature of this vulnerability means that once injected, the malicious code remains persistent across multiple user sessions and page views, amplifying its potential impact. This vulnerability also aligns with ATT&CK technique T1566 - Phishing, as attackers can use it to create convincing fake badge widgets that appear legitimate to unsuspecting users while simultaneously executing malicious payloads.
Organizations utilizing the UsersWP plugin must implement immediate mitigations including upgrading to version 1.2.70 or later where this vulnerability has been addressed through proper input sanitization and output escaping mechanisms. Administrators should also consider implementing additional security measures such as role-based access controls that limit user capabilities within the badge widget functionality, and regular monitoring of user-generated content for suspicious script injections. The vulnerability demonstrates the importance of comprehensive input validation across all user-facing interfaces within WordPress plugins, particularly those that handle dynamic content substitution. Security teams should conduct thorough audits of their WordPress installations to identify other potential vulnerabilities in similar plugin functionalities, as this represents a common pattern of security flaws found in web applications that process user-supplied data without proper sanitization protocols.