Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

14 records

Vendor: stiofansisland Clear all filters
TI-2026-85790 CVE-2026-120671 · GHSA-6q7q-x7h2-hrfr

Stored cross-site scripting in UsersWP plugin via badge shortcode

Priority LOW 28

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'badge' parameter in all versions up to, and…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00206 Published 2026-11-06 No fix listed CWE-79
TI-2026-83502 CVE-2026-119980 · GHSA-8qfx-8gpq-wc4q

Predictable password in UsersWP lets attackers access dummy accounts

Priority LOW 34

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to unauthorized account access via Use of Predictable Password in all versions up to, and includi…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00263 Published 2026-10-31 No fix listed CWE-287
TI-2026-76068 CVE-2026-111110 · GHSA-xm8j-r35j-8pr2

Stored cross-site scripting in GetPaid WordPress plugin

Priority LOW 31

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all versions up to, and including, 2.8.61 due to in…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00278 Published 2026-10-17 No fix listed CWE-79
TI-2026-16210 CVE-2026-19991 · GHSA-mw4c-2xg7-r9h8

UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion

Priority LOW 36

The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the upload_file_remove() AJAX handler.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00652 Published 2026-09-11 No fix listed CWE-22
TI-2026-15191 CVE-2026-18501 · GHSA-36vj-955x-m2pp

UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution

Priority LOW 28

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versio…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00261 Published 2026-08-06 No fix listed CWE-79
TI-2026-14436 CVE-2026-17605 · GHSA-pw6j-6h33-fv96

Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.56 - Authenticated…

Priority LOW 34

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.56 via the getpaid_payment_form_element function.

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.01207 Published 2026-08-01 No fix listed CWE-98
TI-2026-10422 CVE-2026-12102 · GHSA-crv8-pwhc-5w5p

Authorization bypass in stiofansisland UsersWP – Front-end login form, User Registration…

Priority LOW 13

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 vi…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00272 Published 2026-06-18 No fix listed CWE-639
TI-2026-04340 CVE-2026-4979 · GHSA-cfc8-rw2h-jfg7

UsersWP <= 1.2.58 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter

Priority LOW 23

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to blind Server-Side Request Forgery in all versions up to, and including, 1.2.58.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.0037 Published 2026-04-11 No fix listed CWE-918
TI-2026-04338 CVE-2026-4977 · GHSA-72hv-q97x-rw7p

UsersWP <= 1.2.58 - Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter

Priority LOW 20

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to Improper Access Control in all versions up to, and including, 1.2.58 This is due to insufficie…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00302 Published 2026-04-10 No fix listed CWE-862
TI-2025-09182 CVE-2025-10003 · GHSA-pvwj-r85r-hx7j

SQL injection in stiofansisland UsersWP – Front-end login form, User Registration, User…

Priority LOW 37

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘upload_file_remove’ function and 'htmlv…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00355 Published 2025-09-06 No fix listed CWE-89
TI-2025-08566 CVE-2025-9344 · GHSA-9f28-43v5-5c96

UsersWP <= 1.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting

Priority LOW 28

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'uwp_profile' and 'uwp_profile_head…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00246 Published 2025-08-28 No fix listed CWE-79