The vulnerability in UsersWP allows an authenticated attacker with contributor privileges or higher to embed malicious JavaScript into the "badge" shortcode parameter. Because the plugin does not sanitize or escape the badge input, the payload is stored and rendered whenever a page containing the shortcode is loaded, resulting in cross‑site scripting that can run arbitrary scripts in the context of the user viewing the page.

UsersWP – Front‑end login form, User Registration, User Profile & Members Directory plugin for WordPress by stiofansisland. All releases up to and including version 1.2.80 are affected. Users who can add or edit content with contributor or higher roles can exploit the flaw.

With a CVSS score of 6.4 the severity is moderate, and the EPSS score is not available. The vulnerability is not in the CISA KEV catalog. An attacker must be authenticated and have contributor or higher access. The attack flow involves inserting a crafted badge shortcode into a post or page that a higher‑privileged editor or administrator proceeds to preview or view; the malicious script then executes in the browser of that privileged user each time the page is accessed.