UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 100% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price.

1. ★★★★★ grusher

   6mo ago

   Just started to use UsersWP with a Geodirectory site for my local town in Sandwich, Kent and so far so good. Excellent support with any queries and integrates well with what I’m trying to achieve. This topic was modified 4 months, 1 week ago by grusher.

   Read on wp.org ↗
2. ★★★★★ webgeist

   6mo ago

   I would have chosen UsersWP earlier if they had done a better job of presenting the permission features. It’s a very good alternative to Paid Memberships Pro and, when used with GetPaid, is suitable for EU B2B customers.

   Read on wp.org ↗
3. ★★★★★ marcocevoli

   6mo ago

   Very solid plugin and excellent support: they timely and completely answered to all my doubts (and I sent lots of them!)

   Read on wp.org ↗
4. ★★★★★ r0sc0

   6mo ago

   The support team have always been great. Its wonderful using a product where I feel so valued as a customer. 👍

   Read on wp.org ↗
5. ★★★★★ Danielle Zarcaro

   7mo ago

   Such an easy to use plugin. I use it along with other plugins, it’s a really solid solution and I’ve been really happy with it!

   Read on wp.org ↗
6. ★★★★★ ambrogio78

   8mo ago

   I’m happy with the plugin. Combined with geodirectory and reliable support, you can create professional websites. It sometimes requires individual adjustments for your own project, but it works! Thanks!

   Read on wp.org ↗
7. ★★★★★ getfoundautomotive

   9mo ago

   Two years ago, I set out to learn a new skill—something I genuinely enjoyed. I began building my own websites, making plenty of learning curves and mistakes along the way. My goal was to eventually create something that could bring in extra income. I tried many plugins, software companies, and programmes—most filled with technical jargon. At times, I felt like maybe I shouldn’t be doing this at all because I didn’t fully understand what I was doing. Then I discovered UserWP, and later on GeoDirectory and GetPaid. I can honestly say that even though many of the issues I faced were due to my own inexperience (or me accidentally making a mess of something!), the support team was always there. Not only did they point me in the right direction, but they also offered fixes and solutions—even when the problem was more “me” than them. For that, I’m genuinely grateful. The support team has been patient, understanding, efficient, and incredibly quick at resolving issues. The level of support available with these plugins makes them accessible to everyone—from beginners and enthusiasts all the way to seasoned professionals. UserWP, along with the sister plugins GetPaid and GeoDirectory, truly offers a powerful and supportive ecosystem for anyone looking to build and grow their website.

   Read on wp.org ↗
8. ★★★★★ teodor2

   10mo ago

   Good features and it covers my needs, paired up this plugin with Geodirectory, the support has a fairly quick response time, I recommend it!

   Read on wp.org ↗

Recent releases and news for this plugin

1. 2026-08-18 Version 1.2.72 Merge AUI 0.2.52 & SD 1.2.35 – CHANGED 1.2.72
2. 2026-08-17 Version 1.2.71 Arbitrary File Deletion via upload_file_remove() AJAX handler – FIXED/SECURITY 1.2.71
3. 2026-08-03 Version 1.2.70 Badge Widget Variable Substitution – FIXED/SECURITY Merge AUI 0.2.51 & SD 1.2.34 – CHANGED 1.2.70
4. 2026-07-22 Version 1.2.69 Allow username or email on the forgot Password form – FIXED 1.2.69
5. 2026-07-15 Version 1.2.68 Login button text was blank for non-bootstrap design – FIXED 1.2.68
6. 2026-06-30 Version 1.2.67 Password reset and activation links failing as “invalid or expired” on WordPress 6.8+ due to a hashing mismatch with core’s new wp_fast_hash() key storage. – FIXED WP2FA compatibility in login lightbox – FIXED Missing WP 1.2.67

21 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 6.4 UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution ↗
   2026-08-06 CVE-2026-18501 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.2.69 Patched in 1.2.70
2. High · 8.8 UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field ↗
   2026-07-09 CVE-2026-13492 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 1.2.65 Patched in 1.2.66
3. Medium · 5.3 UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP < 1.2.67 - Two-Factor Authentication Bypass ↗
   2026-07-08 CVE-2026-13690 Protection Mechanism Failure Affects < 1.2.67 Patched in 1.2.67
4. Low · 2.7 UsersWP <= 1.2.63 - Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user_id' Parameter ↗
   2026-06-17 CVE-2026-12102 Authorization Bypass Through User-Controlled Key Affects <= 1.2.63 Patched in 1.2.64
5. Medium · 5.0 UsersWP <= 1.2.58 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter ↗
   2026-04-10 CVE-2026-4979 Server-Side Request Forgery (SSRF) Affects <= 1.2.58 Patched in 1.2.59
6. Medium · 4.3 UsersWP <= 1.2.58 - Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter ↗
   2026-04-09 CVE-2026-4977 Missing Authorization Affects <= 1.2.58 Patched in 1.2.59
7. Medium · 6.4 UsersWP <= 1.2.60 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link Substitution ↗
   2026-04-08 CVE-2026-5742 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.2.60 Patched in 1.2.61
8. Medium · 4.3 UsersWP <= 1.2.53 - Cross-Site Request Forgery ↗
   2026-01-28 CVE-2026-25015 Cross-Site Request Forgery (CSRF) Affects <= 1.2.53 Patched in 1.2.54
9. Medium · 4.3 UsersWP <= 1.2.48 - Cross-Site Request Forgery ↗
   2025-12-15 CVE-2025-67593 Cross-Site Request Forgery (CSRF) Affects <= 1.2.48 Patched in 1.2.49
10. Medium · 5.3 UsersWP <= 1.2.47 - Missing Authorization ↗
    2025-11-25 CVE-2025-66072 Missing Authorization Affects <= 1.2.47 Patched in 1.2.48
11. Medium · 6.5 UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.44 - Authenticated (Subscriber+) SQL Injection ↗
    2025-09-05 CVE-2025-10003 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 1.2.44 Patched in 1.2.45
12. Medium · 6.4 UsersWP <= 1.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2025-08-27 CVE-2025-9344 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.2.42 Patched in 1.2.43
13. Medium · 5.3 UsersWP <= 1.2.15 - Missing Authorization ↗
    2024-08-16 CVE-2024-43277 Missing Authorization Affects <= 1.2.15 Patched in 1.2.16
14. Medium · 5.3 UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.11 - Unauthenticated Information Disclosure via Unprotected Directories ↗
    2024-07-13 CVE-2024-6477 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 1.2.11 Patched in 1.2.12
15. Critical · 9.8 UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress <= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort_by' ↗
    2024-06-28 CVE-2024-6265 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 1.2.10 Patched in 1.2.11
16. Medium · 4.3 UsersWP <= 1.2.4 - Cross-Site Request Forgery ↗
    2024-04-10 CVE-2024-31936 Cross-Site Request Forgery (CSRF) Affects <= 1.2.4 Patched in 1.2.6
17. Medium · 6.4 UsersWP <= 1.2.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2024-03-14 CVE-2024-2423 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.2.6 Patched in 1.2.7
18. Medium · 4.3 UsersWP <= 1.2.3.22 - Cross-Site Request Forgery ↗
    2023-11-01 Cross-Site Request Forgery (CSRF) Affects < 1.2.3.23 Patched in 1.2.3.23
19. Medium · 5.5 UsersWP <= 1.2.3.9 - Authenticated (Administrator+) CSV Injection ↗
    2022-12-21 CVE-2022-47442 Improper Neutralization of Formula Elements in a CSV File Affects <= 1.2.3.9 Patched in 1.2.3.10
20. Medium · 4.3 UsersWP <= 1.2.3 - Subscriber+ User Avatar Override ↗
    2022-02-14 CVE-2022-0442 Authorization Bypass Through User-Controlled Key Affects < 1.2.3.1 Patched in 1.2.3.1
21. Medium · 6.1 UsersWP – User Registration & User Profile <= 1.2.2.28 - Reflected Cross-Site Scripting ↗
    2021-09-06 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.2.2.28 Patched in 1.2.2.29

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 18 languages, 2 at 90% or more

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2024-05-21 10K+ → 20K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Pie Register – User Registration, Profiles & Content Restriction 1K+ installs · 4.2★ · 4 shared tags A
• CM Registration – Tailored tool for seamless login and invitation-based registrations 30+ installs · 3.8★ · 4 shared tags B
• User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor 40K+ installs · 4.7★ · 3 shared tags A
• RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login 8K+ installs · 4.5★ · 3 shared tags A
• Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin 200K+ installs · 4.4★ · 2 shared tags A
• Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress 100K+ installs · 3.1★ · 2 shared tags B

Embed this report card

Drop a live Pulse card for UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP into a readme, a review or a deck. It updates itself.

UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP: 20K+ active installs, 4.7★ (183 reviews). Plugin Pulse (WP Mayor), as of 2026-08-29. https://plugins.wpmayor.com/plugin/userswp