Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The UsersWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.2.60. This is due to insufficient input sanitization of user-supplied URL fields and improper output escaping when rendering user profile data in badge widgets. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts that will execute whenever a user accesses a page containing the affected badge widget.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-09 | 1 | Disclosure1 |
| 2026-04-10 | 1 | Disclosure1 |
| 2026-04-19 | 1 | PoC1 |
CVE-2026-5742 The UsersWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.2.60. This is due to insufficient input sanitization of … https://www.cve.org/CVERecord?id=CVE-2026-5742
Post summary
The UsersWP plugin is vulnerable to Stored Cross‑Site Scripting (CVE‑2026‑5742) due to insufficient input sanitization.
https://atomicedge.io/cve-proof/cve-2026-5742-userswp-version-1-2-60-medium-vulnerability-proof-of-concept CVE-2026-5742 #WordPress plugin #vulnerability userswp #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge
Post summary
The text points to a Proof‑of‑Concept page for CVE‑2026‑5742, but offers no further technical or exploit details.
⚡ New CVE Alert: CVE-2026-5742 📊 Severity: 6.4 🚨 Risk Level: Medium 🧩 Affects: Wordpress Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-5742 #CVE-2026-5742 #CVE #Medium #Wordpress #CyberSecurity #InfoSec https://t.co/oH5rpBZHOT
Post summary
The tweet reports a newly disclosed CVE‑2026‑5742 affecting WordPress, notes a medium severity rating of 6.4, and provides a link to the NVD entry.