CVE-2026-94641: WordPress UsersWP plugin <= 1.2.73 - Cross Site Scripting (XSS) vulnerability

Q: Does exploitation require an authenticated WordPress account?

No. The CVSS vector indicates no privileges are required, but user interaction is required for exploitation.

Q: Which installations are affected?

UsersWP versions through 1.2.73 are affected. The available data does not specify a lower affected version boundary.

Q: What is the expected impact if exploitation succeeds?

The vulnerability is rated high severity with low confidentiality, integrity, and availability impacts in the supplied CVSS vector. The vector also indicates scope may change.

Published Oct 9, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan UsersWP userswp allows Reflected XSS.This issue affects UsersWP: from n/a through 1.2.73.

Affected Software

1 affected component

Stiofan UsersWP<=1.2.73

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress UsersWP plugin to a version that resolves this vulnerability.
Fixed in 1.2.74

Event History

Oct 9, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Does exploitation require an authenticated WordPress account?

No. The CVSS vector indicates no privileges are required, but user interaction is required for exploitation.

Which installations are affected?

UsersWP versions through 1.2.73 are affected. The available data does not specify a lower affected version boundary.

What is the expected impact if exploitation succeeds?

The vulnerability is rated high severity with low confidentiality, integrity, and availability impacts in the supplied CVSS vector. The vector also indicates scope may change.

CVE-2026-94641: WordPress UsersWP plugin <= 1.2.73 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Does exploitation require an authenticated WordPress account?

Which installations are affected?

What is the expected impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require an authenticated WordPress account?

Which installations are affected?

What is the expected impact if exploitation succeeds?