CVE-2026-120070

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.3.13 via the postcontent parameter of the submitpost function. The...

CVE-2026-120070 User Frontend <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post_content Parameter

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.3.13 via the postcontent parameter of the submitpost function. The...

CVE-2026-120070

The User Frontend WordPress plugin (versions up to and including 4.3.13 ) is vulnerable to Privilege Escalation via the post_content parameter of the submit_post() function. The flaw arises because the security blocklist checks a sanitize_textarea_field() copy of the content, while the version ac...

EUVD-2026-114657

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.3.13 via the postcontent parameter of the submitpost function. The...

CVE-2026-120070: wedevs: The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend…

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.3.13 via the postcontent parameter of the submitpost function. The...

CVE-2025-14047: Missing Authorization

The Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission – WP User Frontend plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'FrontendFormAjax::submitpost' function in all versions up to,...