84 matches found
CVE-2021-25076
CVE-2021-25076-Exploit Wordpress Plugin WP User Frontend 3.5.26 - SQL-Injection Authenticated CVE description: The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL...
EUVD-2026-85494
Subscriber Arbitrary File Deletion in WP User Frontend = 4.3.11 versions...
CVE-2026-95525
The WP User Frontend plugin for WordPress, affecting versions
EUVD-2026-85493
Unauthenticated Bypass Vulnerability in WP User Frontend = 4.3.11 versions...
EUVD-2026-85492
Subscriber Bypass Vulnerability in WP User Frontend = 4.3.11 versions...
CVE-2026-95523
The WP User Frontend plugin for WordPress, versions
CVE-2026-95524
The WP User Frontend WordPress plugin, affecting versions
CVE-2026-95523: Authentication Bypass by Spoofing
Subscriber Bypass Vulnerability in WP User Frontend = 4.3.11 versions...
CVE-2025-3054-Exploit
CVE-2025-3054 Exploit: Download here Details CVE ID : CVE-2025-3054 Published : June 5, 2025 CVSS : 8.8 Patch Available: No official patch yet Impact The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadfiles functi...
CVE-2026-17563
User Frontend WordPress plugin (versions before 4.3.11 ) enforces its subscription-purchase requirement only when rendering a frontend form, not when processing the actual post submission. This allows unauthenticated users to create—and, depending on form configuration, immediately publish —posts...
CVE-2026-17563 WP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated Form
The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through...
CVE-2026-17563 WP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated Form
The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through...
CVE-2026-81283
Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...
CVE-2026-81283 WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...
CVE-2026-81283 WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...
CVE-2026-81283
WP User Frontend is a WordPress plugin affected by a PHP Object Injection vulnerability in versions 4.3.10 and below . The vulnerability requires low privileges (subscriber-level access), no user interaction, and a low attack complexity, making it accessible to any authenticated subscriber on a s...
EUVD-2026-69922
Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...
CVE-2026-19116
The User Frontend WordPress plugin versions prior to 4.3.11 is vulnerable to PHP Object Injection . The root cause is the failure to prevent user-supplied field values from being deserialized when a submitted post is reopened in the frontend editing form. This flaw allows authenticated users with...
