WordPress Front End Users - Reflected XSS

WordPress Front End Users plugin = 3.2.32 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a...

CVE-2025-2005

CVE-2025-2005 — Front-End Users Arbitrary File Upload CVE-2025-2005 WordPress Front-End Users — Unauthenticated Arbitrary File Upload 0xZ3R0 // h4ckxel 0x00 — Executive Summary Front-End Users is affected by an unauthenticated arbitrary file upload vulnerability affecting versions ≤ 3.2.32. The...

CVE-2025-2005

CVE-2025-2005 WordPress Front End Users Plugin = 3.2.32 is vulnerable to Arbitrary File Upload WordPress Front-End Users Plugin Exploit Vulnerability Information Plugin Name : Front-End Users Plugin Version Affected : = 3.2.32 Vulnerability Type : Arbitrary File Upload CVSS Score : 10 Critical Ri...

CVE-2025-2005

WordPress FEUP Arbitrary File Upload Exploit CVE-2025-2005 This repository provides a Proof of Concept PoC exploit for the WordPress Front End Users plugin versions up to 3.2.32, which is vulnerable to arbitrary file upload due to missing MIME/file-type validation in its registration form.This...

WordPress Front End Users plugin <= 3.2.35 - Unauthenticated Membership Level and Account Status Self-Assignment vulnerability

Unauthenticated Membership Level and Account Status Self-Assignment vulnerability discovered by Ahmed Hashim Ismael in WordPress Plugin Front End Users versions = 3.2.35...

CVE-2026-87835

The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through its front-end forms, allowing unauthenticated users to assign themselves an arbitrary membership level and to mark their own account as approved, confirmed and...

EUVD-2026-109230

The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through its front-end forms, allowing unauthenticated users to assign themselves an arbitrary membership level and to mark their own account as approved, confirmed and...

CVE-2026-87835

The Front End Users WordPress plugin versions through 3.2.35 is vulnerable to an improper access control flaw (CWE-284 ). The plugin fails to restrict which account attributes a visitor can set during registration via its front-end forms. This allows unauthenticated users to assign themselves arb...

CVE-2026-87835 Front End Users <= 3.2.35 - Unauthenticated Membership Level and Account Status Self-Assignment

The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through its front-end forms, allowing unauthenticated users to assign themselves an arbitrary membership level and to mark their own account as approved, confirmed and...

CVE-2026-87835 Front End Users <= 3.2.35 - Unauthenticated Membership Level and Account Status Self-Assignment

The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through its front-end forms, allowing unauthenticated users to assign themselves an arbitrary membership level and to mark their own account as approved, confirmed and...

PT-2026-122510

Name of the Vulnerable Software and Affected Versions Front End Users WordPress plugin versions prior to 3.2.36 Description Unauthenticated users can manipulate account attributes during registration via front-end forms. This allows them to assign themselves arbitrary membership levels and mark...

CVE-2026-22646

Certain error messages returned by the application expose internal system details that should not be visible to end users, providing attackers with valuable reconnaissance information like file paths, database errors, or software versions that can be used to map the application's internal structu...

CVE-2026-22646

Certain error messages returned by the application expose internal system details that should not be visible to end users, providing attackers with valuable reconnaissance information like file paths, database errors, or software versions that can be used to map the application's internal structu...

CVE-2025-65960

Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. This issue has been patched in versions 4.13.57...

CVE-2025-65960: Insufficient Type Distinction

Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. This issue has been patched in versions 4.13.57...

PT-2025-48077

Name of the Vulnerable Software and Affected Versions Contao versions 4.0.0 through 4.13.56 Contao versions 5.3.0 through 5.3.41 Contao versions 5.6.0 through 5.6.4 Description Backend users with control over template closures can execute arbitrary PHP functions without required parameters. The...

CVE-2025-62072

Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users.This issue affects Front End Users: from n/a through = 3.2.33...

EUVD-2025-35366

Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users.This issue affects Front End Users: from n/a through = 3.2.33...

CVE-2025-62072

Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users.This issue affects Front End Users: from n/a through = 3.2.33...

CVE-2025-62072 WordPress Front End Users plugin <= 3.2.33 - Broken Access Control vulnerability

Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users.This issue affects Front End Users: from n/a through = 3.2.33...