55 matches found
CVE-2025-3054-Exploit
CVE-2025-3054 Exploit: Download here Details CVE ID : CVE-2025-3054 Published : June 5, 2025 CVSS : 8.8 Patch Available: No official patch yet Impact The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadfiles functi...
CVE-2021-25076
CVE-2021-25076-Exploit Plugin Wordpress WP User Frontend 3.5.26 - SQL-Injection Autenticata Descrizione della CVE: Il plugin WordPress WP User Frontend precedente alla versione 3.5.26 non valida né esegue l'escape del parametro status prima di utilizzarlo in un'istruzione SQL nella dashboard...
CVE-2026-14567 WP User Frontend < 4.3.10 - Unauthenticated User Email and Phone Disclosure via User Directory
The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators...
CVE-2026-14567
CVE-2026-14567 affects the WP User Frontend WordPress plugin in versions prior to 4.3.10 . The vulnerability stems from an unrestricted user directory search endpoint , which allows unauthenticated attackers to retrieve the email address and phone number of every registered user, including site a...
WordPress User Frontend plugin < 4.3.10 - Unauthenticated User Email and Phone Disclosure vulnerability
Unauthenticated User Email and Phone Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin WP User Frontend versions 4.3.10...
CVE-2026-14558
CVE-2026-14558 affects the WP User Frontend WordPress plugin prior to 4.3.10 . The flaw lies in the AI Form Builder component, which does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts. Users with Editor-level access (or ...
CVE-2026-14558 WP User Frontend < 4.3.10 - Editor+ PHP Object Injection via AI Form Builder
The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code...
CVE-2026-57334 WordPress WP User Frontend plugin <= 4.3.7 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WP User Frontend = 4.3.7 versions...
CVE-2026-42412
Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP User Frontend: from n/a through 4.3.1...
CVE-2026-42412
CVE-2026-42412 affects the WordPress plugin WP User Frontend up to version 4.3.1. The vulnerability is described as a Missing Authorization vulnerability caused by incorrectly configured access control levels (Broken Access Control). CVSS 3.1 base score is 6.5 (Network vector, Low attack complexi...
CVE-2026-42412
Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP User Frontend: from n/a through 4.3.1...
CVE-2026-24364
Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through = 4.2.5...
EUVD-2026-15561
Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through = 4.2.5...
CVE-2026-32485 WordPress WP User Frontend plugin <= 4.2.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through = 4.2.8...
CVE-2026-32485 WordPress WP User Frontend plugin <= 4.2.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through = 4.2.8...
CVE-2026-24364
CVE-2026-24364 is a Missing Authorization vulnerability in the WordPress plugin WP User Frontend (weDevs) affecting versions up to and including 4.2.5. The issue, identified by a researcher (daroo), arises from incorrectly configured access control security levels. Public advisories from Red Hat,...
WordPress WP User Frontend plugin <= 4.2.8 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin WP User Frontend versions = 4.2.8...
CVE-2023-45002
Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 3.6.8...
CVE-2025-14047
The Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission – WP User Frontend plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'FrontendFormAjax::submitpost' function in all versions up to,...