Atomic Edge analysis of CVE-2026-18501:
UsersWP versions 1.2.69 and earlier contain a Stored Cross-Site Scripting (XSS) vulnerability. The flaw resides in the Badge Widget variable substitution functionality, where untrusted user data is substituted into template strings without proper output escaping. This allows authenticated attackers with subscriber-level access to inject arbitrary web scripts that execute when an administrator or other user views the affected page. The CVSS score is 6.4.
Root Cause: The core issue is a failure to sanitize or escape user-provided data before it is inserted into HTML output. In the Badge Widget template processing within includes/helpers/pages.php, the `str_replace` function substitutes the `%%input%%` and `%%profile_url%%` placeholders with values derived from user profile fields. Specifically, the code at lines 384 and 387 replaced these placeholders with the unescaped `$match_value` and `uwp_build_profile_tab_url($user_id)` values. Furthermore, the `uwp_replace_variables` function, which processes `%%variable%%` placeholders with user data, lacked output escaping. This allowed an attacker to store malicious HTML and JavaScript within their profile fields, which is then injected into template output without neutralization.
Exploitation: An attacker with subscriber-level access can exploit this by populating a profile field (e.g., ‘First Name’, ‘Last Name’, or ‘Bio’) with a crafted XSS payload. For instance, setting `first_name` to `alert(document.cookie)`. When an administrator or any user views a page that includes a UsersWP badge with a custom template using the `%%first_name%%` variable, the stored script executes. The payload is stored in the database upon profile update or via the import feature, which lacks proper sanitization for these fields. The vulnerable code path processes the profile data and directly injects it into the badge output.
Patch Analysis: The patch introduces output escaping at multiple critical points. In helpers/pages.php, the `$badge` template is first decoded with `wp_specialchars_decode` to ensure the admin-authored template is represented correctly. Following this, values substituted in via `str_replace` are wrapped in escaping functions: `esc_html` for the `%%input%%` value and `esc_url` for the `%%profile_url%%` value. The `uwp_replace_variables` function now applies `esc_html` to any scalar value before substitution. Additionally, the patch adds sanitization to the import functionality in includes/class-import-export.php, using functions like `sanitize_user`, `sanitize_email`, `sanitize_text_field`, and `sanitize_textarea_field` to clean data on import. This defense-in-depth approach ensures that malicious payloads are neutralized both at the point of storage and at the point of output.
Impact: Successful exploitation allows for Stored Cross-Site Scripting. An attacker can inject malicious scripts that run in the context of any user viewing the compromised page. This can lead to session hijacking, credential theft, defacement of the page, or redirecting users to phishing sites. The impact is limited to users with administrative access who view the badge, as subscribers may not have the same privileges, but a compromised administrator session can lead to full site compromise.
