Description
User Profile WordPress plugin – UserPro (with Social Login)
Now maintained by Marketing the Change – ongoing compatibility updates, security patches, and stability improvements. v5.1.16 is a critical security release and all users should update immediately: it closes a privilege escalation vulnerability (CVSS 9.8) that allowed an unauthenticated visitor to register with the administrator role. v5.1.15 fixed a PHP warning on archive and 404 pages. v5.1.13 resolved all known unbounded database queries that caused 502 errors on large installs. Updating is strongly recommended.
UserPro – A full-featured User Profile and Community WordPress Plugin
Create beautiful front-end user profiles and community sites in WordPress using UserPro.
It comes packed with amazing features like,
+ Customizable login and registration forms
+ Social connect and integration
+ User badges
+ Multiple member list displays
+ Viral marketing
+ Content restriction
+ Public/private feed
+ Verified accounts, and much more.
It is simply an all-in-one plugin to help you create a complete community site. UserPro offers beautiful front-end profiles, login and registration for WordPress. Besides these, UserPro comes with loads of other features like social connect and integration, viral marketing, user badges, verified accounts, content restriction, public/private activity feed, and more.
With UserPro, you can do just about anything you need for your WordPress Community website
+ Build your own community with searchable members directory
+ Give each user a custom and elegant profile
+ Add front-end, customized registration and login to your website
UserPro – All You Need To Setup A Community Website
Follow/Unfollow FeatureFollow, unfollow feature that lets your user follow/unfollow other community members. Ready shortcodes can be used to display Followers and Following |
Social Activity StreamA stream showing recent activities by users on the site like new registration, new post, new comment, new follow etc. Available in two types – Public Activity Stream and Private Activity Stream |
|
Member Listing LayoutsDisplay members in standard table format or collage layout. You can also show customized member’s list |
Member Directory SearchEnable members directory with standard search and filter options. Use custom filters to showcase your members in Enhanced Members Directory |
|
Front End PublisherDo not send your regular members to backend, let them publish directly from frontend. It supports all custom post types and post categories. |
Posts Made By UserShow posts made by user/author on wide content area as well as on sidebar. Show posts by author dynamically. This fully responsive posts by user can be included in User’s profile as well. |
|
Badges & Achievements Manually or automatically assign badges to user roles and display the same on profile page. Supports custom badge upload feature. |
Content RestrictionRestrict full page/post per user roles or for Verified Accounts. Lock entire site/specific page for logged out users. |
|
Essentials
| Intuitive drag and drop administration panel | Compatible with all properly coded WP themes and plugins! | Fully responsive and looks perfect on any screen size |
| 5 ready-to-use skins | Unlimited CSS Support – Easily create and apply custom css and styles | RTL supported |
| 350+ FontAwesome Icons & Unlimited Google Fonts | Translation Ready and available in 12 languages | Auto Update feature available |
Embed a fully customizable registration form anywhere you want
Choose which fields appear during registration, from text inputs to photo and file uploads
Easily organize and re-order your fields, help tooltips, field icons, and more
Control which tabs are collapsed, or collapsible
Have full control on the form/fields
Highly interactive front-end login
Ajax error handling
Tooltips and custom redirection support
Allow users with Social Media Accounts to signin/register instantly
More features:
Front-end user profiles, login & registration for WordPress
Create unlimited custom profile fields of any type – text, drop-down, radio, checkboxes, multiselect
Custom Redirection after login / registration
Create multiple registration forms
Give each registration form an automatic assigned user role (subscriber, customer, manager, etc.)
Control which fields are required for registering, which fields users can edit, which fields are private, and more!
Send an invitation to specific users to register
Enforce strong passwords using Password strength meter
Profile and background pictures uploading from registration form
Enable user role selection on registration form
Allow users to delete their own profiles
Set specific fields as private
Display profile pictures in a Lightbox
Receive email notifications (admins) on profile field updates
Enable social connect and instant profile sync via Facebook, Twitter, LinkedIn and Instagram.
Anyone with social account can register/sign in instantly! (auto-sync)
Viral Social Marketing! Auto post to user’s Twitter Timeline (Optional / Custom message)
Enabled auto-posting on Facebook (when a user publishes a new post via FrontEnd publisher or when a user follows someone).
Seamless Integration
Auto-sync WooCommerce fields
Integration with MyCred. User Points / Awards system is available through myCRED add-on integration.
Sync with BuddyPress profiles – Option to synchronize UserPro profiles with BuddyPress profiles
Built-in Envato Purchase Verification. Built-in integration with Envato’s API
MailChimp Integration
AWeber Integration
Campaign Monitor Integration 
Integrates beautifully with your theme comments
Integrates beautifully with bbPress
Automatic Gravatars support, or users can upload custom profile pictures!
User-uploaded avatars work everywhere (BuddyPress, bbPress, theme comments, etc.)
Lightbox support for user uploaded avatars and photos!
Uses WordPress user meta to ensure compatibility with other plugins
An easy-to-use API, hooks and filters everywhere to help you integrate with any system and modify it to your needs!
Display members in a compact mode
Display an elegant profile card for any user
Display users by specific User Roles
Display users by custom fields
Restrict display of user profiles based on User Roles
Display Online Users
Display user country flag (optional)
Beautiful Frontend Profiles 
Verified Accounts Feature
Users can set their password during registration (optional)
Users can register with e-mail address
Users may login with username or e-mail
Frontend password reset and password change. A unique front-end password reset tool! Users will never see your website’s back-end.
Admin Features
Redirect user to a custom page after login
Redirect user to a custom page after registration
Refresh the same page after login/registration
Manually Approve New Users, Require e-mail validation, or Auto-Approve new signups!
Administration panel to approve/reject registrations and verify users
Improved plugin performance
Block / Unblock user accounts
CSV Export / Import Users
Create multiple front-end registration forms (Show different fields for each group)
Assign a specific User Role automatically for each registration form
Customizable Front-end Registration/Login
Customizable Front-end User Profiles
Unlimited custom fields plus many pre-defined fields
Uses WordPress user meta to ensure compatibility with other plugins
Automatic Video Embeds by video URL only (No embed code required)
Create Date Picker fields
Create unlimited file & photo upload fields
Create unlimited HTML fields (Video embeds, Google maps, any other HTML)
Create required fields (User must fill)
Create locked or private fields
Create hidden fields (visible to admin and profile owner only)
Block Usernames and E-mails from Login/Registration
Automatic Phone Number Validation
Automatic Form Field Length Validation
Allow user to hide fields from public view
Organize fields into collapsible tabs (optional)
Set specific custom fields to be accessible by specific user roles
User Badges and Achievements
Stop Spam registration on your site using Google reCAPTCHA
Replaces the default WordPress e-mail notifications
Customize the name and e-mail that appear on outgoing e-mails
Custom Welcome e-mail (New Registration)
Custom Reset Password e-mail notification
Custom e-mail notification to invite users to Get Verified!
Custom e-mail notifications sent to user
Custom e-mail notifications sent to admin
Media Support
Responsive Videos automatically supported!
Responsive photo uploads with Lightbox support!
Support and Documentation
This plugin is now maintained by Marketing the Change, a Liverpool-based WordPress agency. For support, contact us via userproplugin.com or through Envato. Full documentation is available at userproplugin.com. Need custom development or a specialist to handle setup for you? Our developer is available for minimum tasks via Codeable.
UPDATES
================================== Version 5.1.16 (06 Oct 2026) ================================== - Security fix (critical, CVSS 9.8): Privilege escalation via Unicode homoglyph in registration POST key. An unauthenticated visitor could register with the administrator role by posting a field name containing a Unicode homoglyph character in place of the letter 'i' in wp_capabilities. MySQL's accent-insensitive meta_key collation matched the mutated key to the real capabilities row; the previous denylist did not cover all characters in that equivalence class. Fixed in two layers: (1) sanitize_key() now strips all non-ASCII bytes from POST keys before they reach update_user_meta(); (2) a non-ASCII byte check and sanitize_key()-based denylist added as defense-in-depth in the profile update function. Update immediately. ================================== Version 5.1.15 (02 Oct 2026) ================================== - Fixed bug: PHP warning "Attempt to read property post_name on null" on archive pages, 404s, and other non-post contexts when UserPro was active. ================================== Version 5.1.14 (12 Sep 2026) ================================== - Security fix: SQL injection in the front-end publish flow. Post content was concatenated into a raw query; now uses $wpdb->prepare(). - Security fix: logged-in users could write trust meta to their own account (userpro_verified, account status, social IDs, etc.) via a profile save. A protected-meta denylist now blocks this. - Security fix: plugin settings reset and user invite actions were reachable without authentication via the public nonce. Both now require manage_options. - Security fix: crop/avatar upload had no nonce check and a reflected XSS in the response. Nonce added; output escaped. - Performance fix: member directory custom-field sort now runs in SQL instead of fetching all matching users into PHP. - Performance fix: member directory, EMD and collage all count matches with a single COUNT query instead of a full user fetch. - Stability fix: malformed page/search parameters (?userp=abc, ?userp[]=1, ?userp=-1) no longer cause a PHP 8 fatal or a negative SQL LIMIT. ================================== Version 5.1.13 (14 Aug 2026) ================================== - Performance fix: memberlist pagination now applies to custom-field sort keys. - Performance fix: member directory search/filter total-count now uses a single COUNT query. - Performance fix: userpro_badges_admin_users() capped at 500 rows, fields-only fetch. - Performance fix: delete-all-badge loop now fetches only IDs before per-user write. - Performance fix: User Requests admin panels use COUNT queries for header badges, display capped at 200 rows. - Removed dead get_pending_verify_requests_count() (zero callers, unbounded duplicate). ================================== Version 5.1.12 (14 Aug 2026) ================================== - Performance fix: userpro_rd_get_users() now fetches only ID + user_login, capped at 500 rows. Resolves 502 errors on large installs caused by unbounded WHERE user_id IN (...) queries. - Performance fix: get_pending_verify_requests_count_only() replaced two unbounded get_users() calls with a single COUNT query. Fired on every admin page load. ================================== Version 5.1.11 (10 Feb 2025) ================================== - Fixed bug: Issue that caused settings tabs to not display in the UserPro settings page. ================================== Version 5.1.10 (23 Jan 2025) ================================== - Fixed bug: Register shortcode register_redirect fix. - Fixed bug: Register Ajax error. - Fixed bug: Saving Groups & Fields undefined key warning fix. - Fixed bug: Error while viewing followers. - Security fix. ================================== Version 5.1.9 (29 Apr 2024) ================================== - Fixed bug: Login shortcode login_redirect fix. - Improved stability of user password changes. ================================== Version 5.1.8 (15 Mar 2024) ================================== - Security fix. ================================== Version 5.1.7 (1 Feb 2024) ================================== - Fixed bug: User profile saving fields issue. - Fixed bug: Invitation to register disabled issue. - Security fix. ================================== Version 5.1.6 (29 Nov 2023) ================================== - Fixed bug: User invitation issue. - Security fix.
