CVE-2026-94641: WordPress UsersWP plugin <= 1.2.73 - Cross Site Scripting (XSS) vulnerability
Published Oct 9, 2026
·Updated
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan UsersWP userswp allows Reflected XSS.This issue affects UsersWP: from n/a through 1.2.73.
Affected Software
1 affected component
Stiofan UsersWP<=1.2.73
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress UsersWP pluginto a version that resolves this vulnerability.Fixed in 1.2.74
Event History
Oct 9, 2026
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·10:16 AM
DescriptionSeverityWeakness
Nov 7, 2026
Exploit Published
via GitHub·12:31 PM
Frequently Asked Questions
1
Does exploitation require an authenticated WordPress account?
No. The CVSS vector indicates no privileges are required, but user interaction is required for exploitation.
2
Which installations are affected?
UsersWP versions through 1.2.73 are affected. The available data does not specify a lower affected version boundary.
3
What is the expected impact if exploitation succeeds?
The vulnerability is rated high severity with low confidentiality, integrity, and availability impacts in the supplied CVSS vector. The vector also indicates scope may change.