UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

542 searches this plugin appeared in over the last 90 days, 20 listed. 434 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 100% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 2.4 years ago; the previous band took 3.9 years to cross, which places it about 62% of the way through.

1. ★★★★★ grusher

   8mo ago

   Just started to use UsersWP with a Geodirectory site for my local town in Sandwich, Kent and so far so good. Excellent support with any queries and integrates well with what I’m trying to achieve. This topic was modified 4 months, 1 week ago by grusher.

   Read on wp.org ↗
2. ★★★★★ webgeist

   8mo ago

   I would have chosen UsersWP earlier if they had done a better job of presenting the permission features. It’s a very good alternative to Paid Memberships Pro and, when used with GetPaid, is suitable for EU B2B customers.

   Read on wp.org ↗
3. ★★★★★ marcocevoli

   8mo ago

   Very solid plugin and excellent support: they timely and completely answered to all my doubts (and I sent lots of them!)

   Read on wp.org ↗
4. ★★★★★ r0sc0

   8mo ago

   The support team have always been great. Its wonderful using a product where I feel so valued as a customer. 👍

   Read on wp.org ↗
5. ★★★★★ Danielle Zarcaro

   9mo ago

   Such an easy to use plugin. I use it along with other plugins, it’s a really solid solution and I’ve been really happy with it!

   Read on wp.org ↗
6. ★★★★★ ambrogio78

   10mo ago

   I’m happy with the plugin. Combined with geodirectory and reliable support, you can create professional websites. It sometimes requires individual adjustments for your own project, but it works! Thanks!

   Read on wp.org ↗
7. ★★★★★ getfoundautomotive

   11mo ago

   Two years ago, I set out to learn a new skill—something I genuinely enjoyed. I began building my own websites, making plenty of learning curves and mistakes along the way. My goal was to eventually create something that could bring in extra income. I tried many plugins, software companies, and programmes—most filled with technical jargon. At times, I felt like maybe I shouldn’t be doing this at all because I didn’t fully understand what I was doing. Then I discovered UserWP, and later on GeoDirectory and GetPaid. I can honestly say that even though many of the issues I faced were due to my own inexperience (or me accidentally making a mess of something!), the support team was always there. Not only did they point me in the right direction, but they also offered fixes and solutions—even when the problem was more “me” than them. For that, I’m genuinely grateful. The support team has been patient, understanding, efficient, and incredibly quick at resolving issues. The level of support available with these plugins makes them accessible to everyone—from beginners and enthusiasts all the way to seasoned professionals. UserWP, along with the sister plugins GetPaid and GeoDirectory, truly offers a powerful and supportive ecosystem for anyone looking to build and grow their website.

   Read on wp.org ↗
8. ★★★★★ teodor2

   12mo ago

   Good features and it covers my needs, paired up this plugin with Geodirectory, the support has a fairly quick response time, I recommend it!

   Read on wp.org ↗

Recent releases and news for this plugin

1. 2026-10-30 Version 1.2.79 Dummy test users could be logged into using a public hash – FIXED/SECURITY 1.2.79
2. 2026-10-28 Version 1.2.78 A redirect_to with more than one query arg lost everything after the first on log in, log out, register and lost password links – FIXED AJAX log in and register could redirect to another site through redirect_to; the red 1.2.78
3. 2026-10-07 Version 1.2.77 Fatal error during login 2FA on invalid code with themes that hook wp_login_failed – FIXED 1.2.77
4. 2026-09-30 Version 1.2.75 Login via modal/AJAX shows no error message when the account is not yet activated – FIXED Update AUI 0.2.56 and SD 1.2.37 – CHANGED 1.2.75
5. 2026-09-30 Version 1.2.76 Arbitrary File Deletion via avatar/banner image crop – FIXED/SECURITY 1.2.76
6. 2026-09-16 Version 1.2.74 Update AUI 0.2.54 and SD 1.2.36 – CHANGED 1.2.74

All 25 disclosed vulnerabilities are patched in the current version (1.2.79). Sites still on an older version should update.

1. Patched Medium · 6.5 UsersWP <= 1.2.78 - Unauthenticated Account Access via Predictable Dummy User Password Disclosed through Registration Form Hash ↗
   2026-10-30 CVE-2026-119980 Improper Authentication Affects <= 1.2.78 Patched in 1.2.79
2. Patched Medium · 4.3 UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.74 - Missing Authorization ↗
   2026-10-03 CVE-2026-103086 Missing Authorization Affects <= 1.2.74 Patched in 1.2.76
3. Patched High · 7.2 UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.73 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-10-03 CVE-2026-94641 Improper Neutralization of Input During Web Page Generation Affects <= 1.2.73 Patched in 1.2.74
4. Patched High · 8.1 UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion ↗
   2026-09-10 CVE-2026-19991 Improper Limitation of a Pathname to a Restricted Directory Affects <= 1.2.70 Patched in 1.2.71
5. Patched Medium · 6.4 UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution ↗
   2026-08-06 CVE-2026-18501 Improper Neutralization of Input During Web Page Generation Affects <= 1.2.69 Patched in 1.2.70
6. Patched High · 8.8 UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field ↗
   2026-07-09 CVE-2026-13492 Improper Limitation of a Pathname to a Restricted Directory Affects <= 1.2.65 Patched in 1.2.66
7. Patched Medium · 5.3 UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP < 1.2.67 - Two-Factor Authentication Bypass ↗
   2026-07-08 CVE-2026-13690 Protection Mechanism Failure Affects < 1.2.67 Patched in 1.2.67
8. Patched Low · 2.7 UsersWP <= 1.2.63 - Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user_id' Parameter ↗
   2026-06-17 CVE-2026-12102 Authorization Bypass Through User-Controlled Key Affects <= 1.2.63 Patched in 1.2.64
9. Patched Medium · 5.0 UsersWP <= 1.2.58 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter ↗
   2026-04-10 CVE-2026-4979 Server-Side Request Forgery Affects <= 1.2.58 Patched in 1.2.59
10. Patched Medium · 4.3 UsersWP <= 1.2.58 - Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter ↗
    2026-04-09 CVE-2026-4977 Missing Authorization Affects <= 1.2.58 Patched in 1.2.59
11. Patched Medium · 6.4 UsersWP <= 1.2.60 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link Substitution ↗
    2026-04-08 CVE-2026-5742 Improper Neutralization of Input During Web Page Generation Affects <= 1.2.60 Patched in 1.2.61
12. Patched Medium · 4.3 UsersWP <= 1.2.53 - Cross-Site Request Forgery ↗
    2026-01-28 CVE-2026-25015 Cross-Site Request Forgery Affects <= 1.2.53 Patched in 1.2.54
13. Patched Medium · 4.3 UsersWP <= 1.2.48 - Cross-Site Request Forgery ↗
    2025-12-15 CVE-2025-67593 Cross-Site Request Forgery Affects <= 1.2.48 Patched in 1.2.49
14. Patched Medium · 5.3 UsersWP <= 1.2.47 - Missing Authorization ↗
    2025-11-25 CVE-2025-66072 Missing Authorization Affects <= 1.2.47 Patched in 1.2.48
15. Patched Medium · 6.5 UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.44 - Authenticated (Subscriber+) SQL Injection ↗
    2025-09-05 CVE-2025-10003 Improper Neutralization of Special Elements used in an SQL Command Affects <= 1.2.44 Patched in 1.2.45
16. Patched Medium · 6.4 UsersWP <= 1.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2025-08-27 CVE-2025-9344 Improper Neutralization of Input During Web Page Generation Affects <= 1.2.42 Patched in 1.2.43
17. Patched Medium · 5.3 UsersWP <= 1.2.15 - Missing Authorization ↗
    2024-08-16 CVE-2024-43277 Missing Authorization Affects <= 1.2.15 Patched in 1.2.16
18. Patched Medium · 5.3 UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.11 - Unauthenticated Information Disclosure via Unprotected Directories ↗
    2024-07-13 CVE-2024-6477 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 1.2.11 Patched in 1.2.12
19. Patched Critical · 9.8 UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress <= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort_by' ↗
    2024-06-28 CVE-2024-6265 Improper Neutralization of Special Elements used in an SQL Command Affects <= 1.2.10 Patched in 1.2.11
20. Patched Medium · 4.3 UsersWP <= 1.2.4 - Cross-Site Request Forgery ↗
    2024-04-10 CVE-2024-31936 Cross-Site Request Forgery Affects <= 1.2.4 Patched in 1.2.6
21. Patched Medium · 6.4 UsersWP <= 1.2.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2024-03-14 CVE-2024-2423 Improper Neutralization of Input During Web Page Generation Affects <= 1.2.6 Patched in 1.2.7
22. Patched Medium · 4.3 UsersWP <= 1.2.3.22 - Cross-Site Request Forgery ↗
    2023-11-01 Cross-Site Request Forgery Affects < 1.2.3.23 Patched in 1.2.3.23
23. Patched Medium · 5.5 UsersWP <= 1.2.3.9 - Authenticated (Administrator+) CSV Injection ↗
    2022-12-21 CVE-2022-47442 Improper Neutralization of Formula Elements in a CSV File Affects <= 1.2.3.9 Patched in 1.2.3.10
24. Patched Medium · 4.3 UsersWP <= 1.2.3 - Subscriber+ User Avatar Override ↗
    2022-02-14 CVE-2022-0442 Authorization Bypass Through User-Controlled Key Affects < 1.2.3.1 Patched in 1.2.3.1
25. Patched Medium · 6.1 UsersWP – User Registration & User Profile <= 1.2.2.28 - Reflected Cross-Site Scripting ↗
    2021-09-06 Improper Neutralization of Input During Web Page Generation Affects <= 1.2.2.28 Patched in 1.2.2.29

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 19 languages, 2 at 90% or more

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2024-05-21 10K+ → 20K+ up after 1434 days in tier
2. 2020-06-17 9K+ → 10K+ up after 35 days in tier
3. 2020-05-13 8K+ → 9K+ up after 69 days in tier
4. 2020-03-05 7K+ → 8K+ up after 91 days in tier
5. 2019-12-05 6K+ → 7K+ up after 64 days in tier
6. 2019-10-02 5K+ → 6K+ up after 56 days in tier
7. 2019-08-07 4K+ → 5K+ up after 64 days in tier
8. 2019-06-04 3K+ → 4K+ up after 29 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP into a readme, a review or a deck. It updates itself.

UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP: 20K+ active installs, 4.7★ (183 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/userswp