CVE-2026-18501 describes a stored Cross-Site Scripting vulnerability in the UsersWP plugin for WordPress, specifically affecting the front-end login form, user registration, user profile, and members directory features. The flaw is due to improper neutralization of input during web page generation, allowing authenticated users with subscriber-level privileges or higher to inject arbitrary web scripts via the Badge Widget Variable Substitution. These scripts execute whenever a user accesses the injected page, potentially leading to information disclosure or session hijacking. The vulnerability affects all versions up to and including 1.2.69.

An attacker with subscriber-level access or above can inject persistent malicious scripts into pages viewed by other users. This can lead to limited confidentiality and integrity impacts, such as theft of user credentials or session tokens, but does not affect availability. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user permissions where possible and monitor for suspicious activity. Avoid using the Badge Widget Variable Substitution feature if feasible. Follow vendor updates for patches or official mitigations.