WordPress security by component
User Frontend
User Frontend (user-frontend) is a WordPress plugin with 4 published CVE records in this archive. The latest tracked vulnerability was published Oct 30, 2026; the highest published CVSS base score is 7.2.
Plugin slug:
user-frontendLatest vulnerability
CVE-2026-115277: User Frontend: Reflected cross-site scripting
The User Frontend WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before reflecting them into HTML attributes in a publicly reachable AJAX response, leading to Reflected Cross-Site Scripting. The affected action is gated by an anonymous nonce that only validates for logged-out requests, so the payload executes against logged-out visitors rather than authenticated users. The export does not disclose the attacker authentication requirement. The structured affected range is < 4.3.14.
| Safe version |
|
||
|---|---|---|---|
| Oct 30, 2026 |
CVE-2026-115277
User Frontend: Reflected cross-site scripting
The User Frontend WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before reflecting them into HTML attributes in a publicly reachable AJAX response, leading to Reflected Cross-Site Scripting. The affected action is gated by an anonymous nonce that only validates for logged-out requests, so the payload executes against logged-out visitors rather than authenticated users. The export does not disclose the attacker authentication requirement. The structured affected range is < 4.3.14.
|
4.3.14 |
CVEPending
|
| Sep 02, 2026 |
CVE-2026-17563
User Frontend bypasses subscription checks when accepting post submissions
User Frontend before 4.3.11 enforces a subscription-purchase requirement while rendering a form but not while processing its submission. An unauthenticated visitor can submit directly and create posts; forms configured for immediate publication can publish the post without payment.
|
4.3.11 |
CVE5.3
|
| Aug 28, 2026 |
CVE-2026-14567
User Frontend exposes every user's email address and phone number
User Frontend before 4.3.10 leaves its user-directory search endpoint unrestricted. An unauthenticated attacker can retrieve email addresses and phone numbers for every registered user, including administrators.
|
4.3.10 |
CVE5.3
|
| Aug 28, 2026 |
CVE-2026-14558
User Frontend permits Editor-level PHP object injection
User Frontend before 4.3.10 does not properly validate field-type definitions and deserializes user-controlled post metadata while rendering submitted posts. An Editor can inject PHP objects; where the site has a compatible POP chain, this can lead to remote code execution.
|
4.3.10 |
CVE7.2
|