CVE-2026-96574
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The User Frontend plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpuf_payment_method' parameter in all versions up to and including 4.3.12 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The bypass technique involves appending a valid gateway keyword such as 'bank' to the HTML payload, causing sanitize_text_field() to yield only the keyword for routing purposes while the full malicious raw value is stored and later rendered unescaped.
Risk Assessment
Attackers can inject malicious scripts that execute in users' browsers, leading to session theft, account takeover, or malware distribution. Even low-privilege accounts can be exploited.
Recommendation
Update the User Frontend plugin to the latest version with the fix. Also restrict subscriber account privileges and regularly review user-published content for suspicious scripts.
Other vulnerabilities in User Frontend
See all- CVE-2026-5459Medium
The User Frontend plugin for WordPress versions up to 4.3.1 contains an Insecure Direct Object Reference (IDOR) vulnerability in the payment_page() function. Missing validation on the 'user_id' parameter allows unauthenticated attackers to activate a free subscription pack for any user, overwriting their existing paid subscription and causing loss of paid features.
- CVE-2026-17563Medium
The User Frontend WordPress plugin before version 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.
- CVE-2026-19116High
The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form. This allows authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead to remote code execution when a suitable gadget chain is present on the site.
- CVE-2026-14558High
The User Frontend WordPress plugin before version 4.3.10 does not properly validate field type definitions and deserializes user-controlled post metadata when rendering submitted posts. Users with Editor-level access and above can inject arbitrary PHP objects, which can lead to remote code execution when a suitable POP chain is present on the site.
- CVE-2026-12418Medium
The User Frontend plugin for WordPress up to version 4.3.7 is vulnerable to Insecure Direct Object Reference (IDOR) via the 'wpuf_files_data' parameter. Missing validation on a user-controlled key allows unauthenticated attackers to overwrite the post_title, post_content, and post_excerpt of any arbitrary post, including administrator posts.
- CVE-2026-12406Medium
The User Frontend plugin for WordPress up to version 4.3.7 has an authorization bypass vulnerability. Unauthenticated attackers can delete arbitrary media attachments with post_author 0 via the wpuf_file_del AJAX action.
Original NVD description (English source)
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpuf_payment_method' parameter in all versions up to, and including, 4.3.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The bypass technique involves appending a valid gateway keyword such as 'bank' to the HTML payload, causing sanitize_text_field() to yield only the keyword for routing purposes while the full malicious raw value is stored and later rendered unescaped.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS