User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Attachment Deletion

The WP User Frontend plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check in the FrontendFormAjax::submitpost function. This makes it possible for unauthenticated attackers to delete attachment records through the plugin's AJAX handling when a public...

CVE-2025-3054-Exploit

CVE-2025-3054 Exploit: Download here Details CVE ID : CVE-2025-3054 Published : June 5, 2025 CVSS : 8.8 Patch Available: No official patch yet Impact The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadfiles functi...

CVE-2021-25076

CVE-2021-25076-Exploit Wordpress Plugin WP User Frontend 3.5.26 - SQL-Injection Authenticated CVE description: The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL...

CVE-2026-120070

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.3.13 via the postcontent parameter of the submitpost function. The...

CVE-2026-103962

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'fieldattrrequired' parameter in all versions up to, and including, 4.3.13 due to...

CVE-2026-120070 User Frontend <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post_content Parameter

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.3.13 via the postcontent parameter of the submitpost function. The...

EUVD-2026-114657

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.3.13 via the postcontent parameter of the submitpost function. The...

CVE-2026-120070

The User Frontend WordPress plugin (versions up to and including 4.3.13 ) is vulnerable to Privilege Escalation via the post_content parameter of the submit_post() function. The flaw arises because the security blocklist checks a sanitize_textarea_field() copy of the content, while the version ac...

EUVD-2026-114651

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'fieldattrrequired' parameter in all versions up to, and including, 4.3.13 due to...

CVE-2026-103962 User Frontend <= 4.3.13 - Reflected Cross-Site Scripting via 'field_attr[required]' Parameter

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'fieldattrrequired' parameter in all versions up to, and including, 4.3.13 due to...

CVE-2026-103962

The User Frontend WordPress plugin (versions up to and including 4.3.13 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping related to the 'field_attr[required]' parameter. An unauthenticated attacker can inject arbitrary...

CVE-2026-103962: wedevs: The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend…

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'fieldattrrequired' parameter in all versions up to, and including, 4.3.13 due to...

PT-2026-134468

Name of the Vulnerable Software and Affected Versions User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission versions prior to 4.3.14 Description Insufficient input sanitization and output escaping allow unauthenticated...

CVE-2026-120070: wedevs: The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend…

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.3.13 via the postcontent parameter of the submitpost function. The...

PT-2026-134479

Name of the Vulnerable Software and Affected Versions User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission versions prior to 4.3.14 Description Authenticated users with Subscriber-level access and above can escalate their...

WordPress User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Kuba in WordPress Plugin WP User Frontend versions = 4.3.13...

WordPress User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin <= 4.3.13 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Dthangws in WordPress Plugin WP User Frontend versions = 4.3.13...

WordPress User Frontend plugin < 4.3.14 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Jasper Weijts in WordPress Plugin WP User Frontend versions 4.3.14...

CVE-2026-115277

The User Frontend WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before reflecting them into HTML attributes in a publicly reachable AJAX response, leading to Reflected Cross-Site Scripting. The affected action is gated by an anonymous nonce that only...

EUVD-2026-113725

The User Frontend WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before reflecting them into HTML attributes in a publicly reachable AJAX response, leading to Reflected Cross-Site Scripting. The affected action is gated by an anonymous nonce that only...