CVE-2026-103962
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The User Frontend plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'field_attr[required]' parameter in versions up to and including 4.3.13 due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts that execute if they trick a user into clicking a link. The nonce check is ineffective because the wpuf_nonce value is publicly available to every anonymous visitor.
Risk Assessment
This can lead to session hijacking or execution of malicious actions in the victim's browser context. Website users are exposed to phishing attacks and account takeover.
Recommendation
Update the User Frontend plugin to a version later than 4.3.13. Consider implementing additional XSS protections such as CSP headers.
Other vulnerabilities in User Frontend
See all- CVE-2026-5459Medium
The User Frontend plugin for WordPress versions up to 4.3.1 contains an Insecure Direct Object Reference (IDOR) vulnerability in the payment_page() function. Missing validation on the 'user_id' parameter allows unauthenticated attackers to activate a free subscription pack for any user, overwriting their existing paid subscription and causing loss of paid features.
- CVE-2026-120070High
The User Frontend plugin for WordPress (up to 4.3.13) is vulnerable to Privilege Escalation via the 'post_content' parameter in submit_post(). A control byte can bypass the shortcode blocklist, allowing injection of a registration shortcode with 'editor' role. This lets authenticated attackers with Subscriber-level access create an Editor account.
- CVE-2026-96574Medium
The User Frontend plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpuf_payment_method' parameter in all versions up to and including 4.3.12 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The bypass technique involves appending a valid gateway keyword such as 'bank' to the HTML payload, causing sanitize_text_field() to yield only the keyword for routing purposes while the full malicious raw value is stored and later rendered unescaped.
- CVE-2026-17563Medium
The User Frontend WordPress plugin before version 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.
- CVE-2026-19116High
The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form. This allows authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead to remote code execution when a suitable gadget chain is present on the site.
- CVE-2026-14558High
The User Frontend WordPress plugin before version 4.3.10 does not properly validate field type definitions and deserializes user-controlled post metadata when rendering submitted posts. Users with Editor-level access and above can inject arbitrary PHP objects, which can lead to remote code execution when a suitable POP chain is present on the site.
- CVE-2026-12418Medium
The User Frontend plugin for WordPress up to version 4.3.7 is vulnerable to Insecure Direct Object Reference (IDOR) via the 'wpuf_files_data' parameter. Missing validation on a user-controlled key allows unauthenticated attackers to overwrite the post_title, post_content, and post_excerpt of any arbitrary post, including administrator posts.
- CVE-2026-12406Medium
The User Frontend plugin for WordPress up to version 4.3.7 has an authorization bypass vulnerability. Unauthenticated attackers can delete arbitrary media attachments with post_author 0 via the wpuf_file_del AJAX action.
Original NVD description (English source)
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'field_attr[required]' parameter in all versions up to, and including, 4.3.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The nonce check on the wpuf_get_child_cat AJAX action is not an effective security barrier because the wpuf_nonce value is publicly localized to every anonymous visitor of any page containing a WPUF shortcode, making it freely harvestable by an unauthenticated attacker.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS