Known vulnerabilities in UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP

Light weight Front-end login form, User Registration, User Profile and Members Directory plugin.

21Reported vulnerabilities

9.8Highest CVSS score

1.2.71Latest version

20,000+Active installs

What to do now

Update UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP to 1.2.70 or later. 21 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 17, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2024-6477	High 7.5	0.6%	Before 1.2.12	`1.2.12`	August 3, 2024
CVE-2024-6265	Critical 9.8	2.4%	Before 1.2.11	`1.2.11`	June 29, 2024
CVE-2026-13492	High 8.8	0.7%	0 to 1.2.65 (inclusive)	`1.2.66`	July 9, 2026
CVE-2022-0442	Medium 4.3	0.7%	Before 1.2.3.1	`1.2.3.1`	March 7, 2022
CVE-2025-10003	Medium 6.5	0.3%	0 to 1.2.44 (inclusive)	`1.2.45`	September 6, 2025
CVE-2024-2423	Medium 6.4	0.4%	Before 1.2.7	`1.2.7`	April 9, 2024
CVE-2026-18501	Medium 6.4	0.2%	1.2.69 and earlier	`1.2.70`	August 6, 2026
CVE-2026-5742	Medium 6.4	0.2%	0 to 1.2.60 (inclusive)	`1.2.61`	April 9, 2026
CVE-2025-9344	Medium 6.4	0.2%	1.2.42 and earlier	`1.2.43`	August 27, 2025
WF-1522d23b-7655-4fde-a18b-b46c6625185f	Medium 6.1	—	1.2.2.28 and earlier	`1.2.2.29`	September 6, 2021
CVE-2022-47442	Medium 5.5	0.7%	1.2.3.9 and earlier	`1.2.3.10`	December 21, 2022
CVE-2026-13690	Medium 5.3	0.3%	Before 1.2.67	`1.2.67`	July 8, 2026
CVE-2025-66072	Medium 5.3	0.2%	1.2.47 and earlier	`1.2.48`	November 25, 2025
CVE-2024-43277	Medium 5.3	0.4%	1.2.15 and earlier	`1.2.16`	August 16, 2024
CVE-2026-4979	Medium 5	0.4%	0 to 1.2.58 (inclusive)	`1.2.59`	April 11, 2026
CVE-2026-4977	Medium 4.3	0.3%	0 to 1.2.58 (inclusive)	`1.2.59`	April 10, 2026
CVE-2026-25015	Medium 4.3	0.1%	1.2.53 and earlier	`1.2.54`	January 28, 2026
CVE-2025-67593	Medium 4.3	0.1%	1.2.48 and earlier	`1.2.49`	December 15, 2025
CVE-2024-31936	Medium 4.3	0.2%	1.2.4 and earlier	`1.2.6`	April 10, 2024
WF-413d3ec0-8d04-4bef-9394-f666cfed733e	Medium 4.3	—	Before 1.2.3.23	`1.2.3.23`	November 1, 2023
CVE-2026-12102	Low 2.7	0.3%	0 to 1.2.63 (inclusive)	`1.2.64`	June 18, 2026

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.