CVE-2026-94641: XSS in UsersWP WordPress Plugin

CVE-2026-94641 identifies a Reflected Cross-Site Scripting (XSS) vulnerability in the UsersWP WordPress plugin. The flaw allows injection of malicious JavaScript code through unfiltered input during web page generation. Affected versions include UsersWP releases up to and including 1.2.73. The impact directly affects WordPress administrators using this plugin for user management.

The vulnerability scores CVSS 7.1 (HIGH severity), a significant risk for production sites. On 2026-11-07, public GitHub repositories declared to contain proof-of-concept code. NVD registered the CVE on 2026-10-09. No official information about patch availability or timeline is available. Administrators should treat this as an immediate operational priority, given the unauthenticated nature of the exploit and public visibility.

Immediately verify which UsersWP version is installed across your sites. Monitor the official plugin repository for patch announcements. Pending a confirmed fix, consider: temporary plugin disablement; deployment of Web Application Firewall (WAF) rules specific to Reflected XSS; access restrictions to plugin features via trusted IP lists. Document the risk in your asset management systems. Await communications from the plugin development team regarding patch timelines.