365 matches found
CVE-2026-19116
The User Frontend WordPress plugin before version 4.3.11 is vulnerable to PHP Object Injection because it fails to prevent the deserialization of user-supplied field values. This occurs when a submitted post is reopened within its frontend editing form. Attackers with subscriber-level access or h...
PT-2026-84683
Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...
CVE-2026-81283: Deserialization of Untrusted Data
Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...
WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by VanTastic in WordPress Plugin WP User Frontend versions = 4.3.10...
CVE-2026-66047: Missing Authentication for Critical Function
ProfilePress wp-user-avatar WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppressconnectprocess AJAX handler...
CVE-2026-14567 WP User Frontend < 4.3.10 - Unauthenticated User Email and Phone Disclosure via User Directory
The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators...
CVE-2026-14567 WP User Frontend < 4.3.10 - Unauthenticated User Email and Phone Disclosure via User Directory
The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators...
WordPress User Frontend plugin < 4.3.10 - Unauthenticated User Email and Phone Disclosure vulnerability
Unauthenticated User Email and Phone Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin WP User Frontend versions 4.3.10...
CVE-2026-14567
The User Frontend WordPress plugin, in versions before 4.3.10 , is vulnerable to an information disclosure flaw because it fails to restrict access to its user directory search endpoint . This allows unauthenticated attackers to retrieve the email addresses and phone numbers of all registered use...
CVE-2026-14558 WP User Frontend < 4.3.10 - Editor+ PHP Object Injection via AI Form Builder
The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code...
CVE-2026-14558
The User Frontend WordPress plugin, in versions before 4.3.10 , is vulnerable to a PHP Object Injection flaw. The root cause is the failure to properly validate field type definitions, leading to the deserialization of user-controlled post metadata during the rendering of submitted posts. This vu...
CVE-2026-14558 WP User Frontend < 4.3.10 - Editor+ PHP Object Injection via AI Form Builder
The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code...
PT-2026-72145
Name of the Vulnerable Software and Affected Versions Propovoice: All-in-One Client Management System versions prior to 1.7.9 Description An issue exists where the REST endpoint of the create function fails to validate the user-supplied role parameter against a list of permitted WordPress roles a...
WP User Manager – User Profile Builder & Membership - Local File Inclusion Detection
WP User Manager – User Profile Builder & Membership plugin for WordPress = 2.9.17 contains a local file inclusion caused by improper handling in the profile template scope function, letting unauthenticated attackers execute arbitrary PHP code, exploit requires ability to upload or control PHP...
📄 WordPress WP User Frontend 4.2.4 Unauthenticated Arbitrary Attachment/File Deletion
WordPress WP User Frontend plugin version 4.2.4 contains an unauthenticated arbitrary attachment/file deletion vulnerability. A remote attacker can delete arbitrary files accessible to the affected WordPress installation. This proof of concept exploit demonstrates the vulnerable request flow...
Exploit for CVE-2026-9290
CVE-2026-9290 — WP User Manager LFI to RCE Exploit Pre-Auth Path...
CVE-2026-57334 WordPress WP User Frontend plugin <= 4.3.7 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WP User Frontend = 4.3.7 versions...
CVE-2026-57334: Missing Authorization
Unauthenticated Broken Access Control in WP User Frontend = 4.3.7 versions...