The UsersWP plugin stores user‑supplied URLs in badge widgets without sufficient sanitization and then outputs them without proper escaping. This allows an authenticated attacker with subscriber–level access or higher to inject arbitrary scripts. When another user views a page displaying the affected badge widget, the injected script executes in that user’s browser, potentially stealing session cookies or performing other malicious actions. The vulnerability provides a moderate level of risk, as it can impact confidentiality and integrity of user sessions and may be used for defacement.

WordPress Sites running the UsersWP plugin from any author under the stiofansisland namespace, specifically versions 1.2.60 and earlier. The vulnerability affects the front‑end login form, user registration, profile, and members directory components that render badge widgets.

The CVSS score of 6.4 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate to the site with a subscriber or higher role. Once authenticated, they can submit a malicious URL into the badge widget; the stored payload then reflects to any visitor of the page containing that widget, enabling cross‑site scripting. The attack path is straightforward and does not require additional privileges beyond the subscriber role, making exploitation feasible for sites with open or publicly exposed subscriber accounts.