UsersWP plugin versions up to 1.2.73 contain a reflected cross‑site scripting flaw that occurs when user supplied input is not properly neutralized before being sent to the browser. An attacker can craft a URL or form submission that injects malicious JavaScript, which is then executed by any browser that renders the affected page. This can lead to session hijacking, credential theft, defacement, or further malware delivery. The weakness is identified as insecure input handling (CWE‑79).

The vulnerability affects the WordPress UsersWP plugin from the earliest publicly released version through 1.2.73 inclusive. Hosts running any of these versions on a WordPress site, regardless of the WordPress core version, are at risk. The plugin is commonly used for user management and profile display, so many WordPress installations could be impacted.

With a CVSS score of 7.1, the vulnerability is rated high severity. The EPSS score is not provided, so the current exploitation probability cannot be quantified, but reflected XSS is generally easy to exploit without special prerequisites, especially when the plugin accepts query parameters or user‑controlled content. The vulnerability is not listed in the CISA KEV catalog, indicating no known mass exploitation yet. An attacker could simply rely on the victim visiting a crafted URL or clicking a malicious link that includes the injection, making the risk significant for sites with open access to the affected plugin pages.