Skip to content
PluginCanary

UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WP

by Stiofan · 20,000+ active installs · Checked 3 Nov 2026
Watch4 Warnings

Watch: vulnerability published 30 Oct 2026, fixed in 1.2.79.

78/ 100 Canary Score
Sub-scores for UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WP
Ownership100
Maintenance100
Security60
Support50
Reputation70

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 30 Oct 2026, fixed in 1.2.79. Update to version 1.2.79 or later.30 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 3 Oct 2026, fixed in 1.2.76. Update to version 1.2.76 or later.3 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 3 Oct 2026, fixed in 1.2.74. Update to version 1.2.74 or later.3 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 10 Sep 2026, fixed in 1.2.71. Update to version 1.2.71 or later.10 Sep 2026Evidence
  • InfoSEC-316 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
stiofansisland27 Jul 2017 to 3 Nov 2026, 179 commits
wpdev106 May 2019 to 30 Oct 2019, 5 commits

2 committers recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
yesterday
Releases, 24 months
60
Tested up to
7.1 current
Requires PHP
not stated supported 8.2+
Releases per quarter for UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WP
Q1 20245
Q2 20242
Q3 20248
Q4 20248
Q1 20254
Q2 20255
Q3 20259
Q4 20257
Q1 20266
Q2 20268
Q3 20269
Q4 20265

Last release 3 Nov 2026. Tested with WordPress 7.1 (current).

Support

50% of 6 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
30 Oct 2026UsersWP <= 1.2.78 - Unauthenticated Account Access via Predictable Dummy User Password Disclosed through Registration Form Hash6.5<= 1.2.781.2.790
3 Oct 2026UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.74 - Missing Authorization4.3<= 1.2.741.2.760
3 Oct 2026UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.73 - Unauthenticated Stored Cross-Site Scripting7.2<= 1.2.731.2.740
10 Sep 2026UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion8.1<= 1.2.701.2.710
6 Aug 2026UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution6.4<= 1.2.691.2.700
9 Jul 2026UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field8.8<= 1.2.651.2.660
8 Jul 2026UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP < 1.2.67 - Two-Factor Authentication Bypass5.3< 1.2.671.2.670
17 Jun 2026UsersWP <= 1.2.63 - Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user_id' Parameter2.7<= 1.2.631.2.640
10 Apr 2026UsersWP <= 1.2.58 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter5<= 1.2.581.2.590
9 Apr 2026UsersWP <= 1.2.58 - Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter4.3<= 1.2.581.2.590
8 Apr 2026UsersWP <= 1.2.60 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link Substitution6.4<= 1.2.601.2.610
28 Jan 2026UsersWP <= 1.2.53 - Cross-Site Request Forgery4.3<= 1.2.531.2.540
15 Dec 2025UsersWP <= 1.2.48 - Cross-Site Request Forgery4.3<= 1.2.481.2.490
25 Nov 2025UsersWP <= 1.2.47 - Missing Authorization5.3<= 1.2.471.2.480
5 Sep 2025UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.44 - Authenticated (Subscriber+) SQL Injection6.5<= 1.2.441.2.450
27 Aug 2025UsersWP <= 1.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 1.2.421.2.430
16 Aug 2024UsersWP <= 1.2.15 - Missing Authorization5.3<= 1.2.151.2.160
13 Jul 2024UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.11 - Unauthenticated Information Disclosure via Unprotected Directories5.3<= 1.2.111.2.120
28 Jun 2024UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress <= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort_by'9.8<= 1.2.101.2.110
10 Apr 2024UsersWP <= 1.2.4 - Cross-Site Request Forgery4.3<= 1.2.41.2.60
14 Mar 2024UsersWP <= 1.2.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode6.4<= 1.2.61.2.71
1 Nov 2023UsersWP <= 1.2.3.22 - Cross-Site Request Forgery4.3< 1.2.3.231.2.3.230
21 Dec 2022UsersWP <= 1.2.3.9 - Authenticated (Administrator+) CSV Injection5.5<= 1.2.3.91.2.3.100
14 Feb 2022UsersWP <= 1.2.3 - Subscriber+ User Avatar Override4.3< 1.2.3.11.2.3.10
6 Sep 2021UsersWP – User Registration & User Profile <= 1.2.2.28 - Reflected Cross-Site Scripting6.1<= 1.2.2.281.2.2.290

Source: Wordfence Intelligence.

Reputation

Average rating per quarter for UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WP
Q2 20245.0
Q3 20245.0
Q4 20244.4
Q1 20255.0
Q2 20254.0
Q3 20255.0
Q4 20255.0
Q1 20265.0

Average rating stayed at 5.0 between Q2 2024 and Q1 2026.

Rating distribution
5 star162
4 star4
3 star6
2 star2
1 star9
Latest low reviews

Momentum

20,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WP
4 May 20268,433
11 May 20269,804
18 May 20263,030
25 May 20261,367
1 Jun 20261,174
8 Jun 20267,530
15 Jun 20264,114
22 Jun 20269,337
29 Jun 20269,631
6 Jul 20264,505
13 Jul 202610,494
20 Jul 20269,495
27 Jul 20262,170
3 Aug 202610,822
10 Aug 20262,772
17 Aug 202617,290
24 Aug 20262,271
31 Aug 20261,967
7 Sep 20262,396
14 Sep 202616,623
21 Sep 20262,693
28 Sep 20269,563
5 Oct 202611,384
12 Oct 20262,719
19 Oct 20262,063
26 Oct 202617,719
2 Nov 20262,649

Weekly downloads over the last 4 weeks are 8% below the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

LoginWP (Formerly Peter's Login Redirect)Score 92 · 80,000+Simple User AvatarScore 92 · 20,000+Gravatar Enhanced - Avatars, Profiles, and PrivacyScore 91 · 100,000+WP User AvatarsScore 91 · 20,000+Sidebar LoginScore 91 · 9,000+

Facts

Version1.2.81
AuthorStiofan
Added27 Jul 2017
Last updated3 Nov 2026
Active installs20,000+
Requires WordPress6.1
Tested up to7.1.4
Requires PHPnot stated
CategoryUser Management & Authentication > User Registration & Login
Tagslogin form, registration, user profile, registration form, User Registration

Other plugins by this author: API KEY for Google Maps, AyeCode Connect, Payment forms, Buy now buttons, and Invoicing System | GetPaid, UsersWP - ReCaptcha, Events Calendar for GeoDirectory, UsersWP - Social Login, BlockStrap Page Builder - Bootstrap Blocks, GetPaid Stripe Payments, GetPaid > Wallet, Quotes Addon for GetPaid, GetPaid > Item Inventory

Questions

Is UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WP still maintained?

UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WP was last updated on 3 Nov 2026. Its Canary status is Watch.

Is UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WP safe?

UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WP has no open unpatched vulnerabilities on record. 16 vulnerabilities were published in the last 24 months. Its Canary status is Watch.

Who owns UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WP?

The wordpress.org author is Stiofan. Recent committers: stiofansisland, wpdev10, plugin-master. We have recorded no ownership change.

What can I use instead of UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WP?

Plugins in the same category with a higher Canary Score: LoginWP (Formerly Peter's Login Redirect), Simple User Avatar, Gravatar Enhanced - Avatars, Profiles, and Privacy, WP User Avatars, Sidebar Login.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue