Front End Users vulnerabilities

The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through its front-end forms. This allows unauthenticated users to assign themselves an arbitrary membership level and to mark their own account as approved, confirmed and paid, bypassing the plugin's content restrictions and registration gating.

The Front End Users plugin for WordPress has a missing authorization vulnerability affecting versions up to and including 3.2.33. The issue allows unauthorized access to functions that should require appropriate permissions.

The Front End Users WordPress plugin contains a Stored XSS vulnerability due to improper input neutralization during web page generation. This allows persistent injection of malicious scripts.