CVE-2026-18501 is a stored cross-site scripting vulnerability in the UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress. The issue exists in all versions up to and including 1.2.69 due to improper neutralization of input during web page generation, specifically in the Badge Widget Variable Substitution functionality. Authenticated attackers with subscriber-level privileges can inject arbitrary web scripts that execute when other users access the injected pages. This vulnerability can lead to information disclosure and session hijacking but does not impact availability. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).

An attacker with subscriber-level access or higher can inject persistent malicious scripts into pages via the Badge Widget Variable Substitution. These scripts execute in the context of other users who view the affected pages, potentially leading to partial confidentiality and integrity loss such as session hijacking or data theft. There is no impact on system availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level user capabilities if possible and monitor for suspicious activity related to widget content. Avoid using the Badge Widget Variable Substitution feature if feasible. Follow vendor updates for official patches or mitigations.