Medium
CVE-2026-103086
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 25
Reset filters
High
CVE-2026-94641
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.73 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-86814
UsersWP - Social Login <= 1.5.9 - Unauthenticated Privilege Escalation
High
CVE-2026-19991
UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion
Medium
CVE-2026-18501
UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution
High
CVE-2026-13492
UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field
Medium
CVE-2026-13690
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP < 1.2.67 - Two-Factor Authentication Bypass
Low
CVE-2026-12102
UsersWP <= 1.2.63 - Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user_id' Parameter
Medium
CVE-2026-4979
UsersWP <= 1.2.58 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter
Medium
CVE-2026-4977
UsersWP <= 1.2.58 - Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter
Medium
CVE-2026-5742
UsersWP <= 1.2.60 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link Substitution
Medium
CVE-2026-25015
UsersWP <= 1.2.53 - Cross-Site Request Forgery
Medium
CVE-2025-67593
UsersWP <= 1.2.48 - Cross-Site Request Forgery
Medium
CVE-2025-66072
UsersWP <= 1.2.47 - Missing Authorization
Medium
CVE-2025-10003
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.44 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-9344
UsersWP <= 1.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-43277
UsersWP <= 1.2.15 - Missing Authorization
Medium
CVE-2024-6477
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.11 - Unauthenticated Information Disclosure via Unprotected Directories
Critical
CVE-2024-6265
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress <= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort_by'
Medium
CVE-2024-31936
UsersWP <= 1.2.4 - Cross-Site Request Forgery
Medium
CVE-2024-2423
UsersWP <= 1.2.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
413d3ec0-8d04-4bef-9394-f666cfed733e
UsersWP <= 1.2.3.22 - Cross-Site Request Forgery
Medium
CVE-2022-47442
UsersWP <= 1.2.3.9 - Authenticated (Administrator+) CSV Injection
Medium
CVE-2022-0442
UsersWP <= 1.2.3 - Subscriber+ User Avatar Override
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.