CVE-2021-25076 WP User Frontend < 3.5.26 - SQL Injection to Reflected Cross-Site Scripting

2022-01-2408:01:24

CWE-89

WPScan

www.cve.org

8.9 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

77.2%

JSON

The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting

CNA Affected

[
  {
    "product": "WP User Frontend – Membership, Profile, Registration & Post Submission Plugin for WordPress",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "3.5.26",
        "status": "affected",
        "version": "3.5.26",
        "versionType": "custom"
      }
    ]
  }
]