Stiofansisland
Vulnerability activity for Stiofansisland: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 3
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 4
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 4
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 6.4MediumNov 6, 2026Stiofansisland UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP XSSCVE-2026-120671The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'badge' parameter in all versions up to, and including, 1.2.80 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The ex
- 6.5MediumOct 31, 2026Stiofansisland UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP Auth bypass / access controlCVE-2026-119980The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to unauthorized account access via Use of Predictable Password in all versions up to, and including, 1.2.78 The vulnerability exists because `get_dummy_user_passowrd()` derives the shared password for all 25 built-in dummy user accounts as the first 15 characters of `substr(hash('SHA256', AUTH_KEY . site_url()), 0, 25)`, while the full 25-character value of that same hash is
- 7.2HighOct 17, 2026Stiofansisland Payment forms, Buy now buttons, and Invoicing System | GetPaid XSSCVE-2026-111110The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all versions up to, and including, 2.8.61 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required nonce (getpaid_form_nonce) is publicly emitted to all visitor
- 8.1HighSep 11, 2026Stiofansisland UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP Path traversal / file handlingCVE-2026-19991The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the upload_file_remove() AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $_POST when no real $_FILES upload is provided (process_account() calls uwp_validate_fields() and array_merges the result with the empty output of UsersWP_Files::validate_uploads()). At storage time the value is only checked with validate_file(), which passes an
Top products
- UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP3 CVEs in the last year
- Payment forms, Buy now buttons, and Invoicing System | GetPaid1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.