CVE-2026-115277

The User Frontend WordPress plugin (versions before 4.3.14 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape user-supplied values before reflecting them into HTML attributes within a publicly reachable AJAX response . Specifica...

CVE-2026-115277 WP User Frontend < 4.3.14 - Reflected XSS via 'field_attr' Parameter

The User Frontend WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before reflecting them into HTML attributes in a publicly reachable AJAX response, leading to Reflected Cross-Site Scripting. The affected action is gated by an anonymous nonce that only...