CVE-2025-58235
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Front End Users WordPress plugin contains a Stored XSS vulnerability due to improper input neutralization during web page generation. This allows persistent injection of malicious scripts.
Risk Assessment
A malicious script can be stored on the server and executed every time the page is viewed, potentially leading to data theft, session hijacking, or malware distribution.
Recommendation
Update the Front End Users plugin to the latest available version that includes a fix for this vulnerability.
Other vulnerabilities in Front End Users
See all- CVE-2026-87835Unknown
The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through its front-end forms. This allows unauthenticated users to assign themselves an arbitrary membership level and to mark their own account as approved, confirmed and paid, bypassing the plugin's content restrictions and registration gating.
- CVE-2025-62072Medium
The Front End Users plugin for WordPress has a missing authorization vulnerability affecting versions up to and including 3.2.33. The issue allows unauthorized access to functions that should require appropriate permissions.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Front End Users front-end-only-users allows Stored XSS.This issue affects Front End Users: from n/a through <= 3.2.35.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS