CVE-2021-25076

The WP User Frontend WordPress plugin, versions prior to 3.5.26 , is vulnerable to SQL injection and potentially Reflected Cross-Site Scripting . The root cause is the failure to validate or escape the status parameter before its inclusion in an SQL statement within the Subscribers dashboard . An...

CVE-2024-38693

CVE-2024-38693 describes an SQL Injection in the WordPress plugin WP User Frontend up to version 4.0.7, arising from improper neutralization of special elements in SQL commands. Public details across sources identify affected software as WP User Frontend with versions ≤ 4.0.7 and indicate a patch...

CVE-2021-24649

The CVE refers to the WP User Frontend WordPress plugin prior to version 3.5.29. A user-supplied argument in the registration form, urhidden, encodes the account role (encrypted via wpuf_encryption). If an attacker can access AUTH_KEY and AUTH_SALT (e.g., via arbitrary file access or default keys...