Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-07
Wp User Frontend - Security Vulnerability (CVE-2026-109214)
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' (default: 'category')' parameter in all versions up to, and including, 4.3.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the target installation to have configured a Taxonomy field in text-input mode with guest post…
PLUGIN
Wp User Frontend
CVE-2026-109214
Risk Score
Threat Entry
Updated 2026-11-06
Wp User Frontend - Security Vulnerability (CVE-2026-120070)
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.3.13 via the `post_content` parameter of the `submit_post()` function. The vulnerability exists because the protected-shortcode blocklist guard inspects the `sanitize_textarea_field()` copy of the submitted `post_content`, while the copy actually persisted to the database is processed through `wp_kses()`, whose `wp_kses_no_null()` step strips C0 control bytes — allowing an attacker to inject a single `\x01` byte inside the `[wpuf-registration]`…
PLUGIN
Wp User Frontend
CVE-2026-120070
Risk Score
Threat Entry
Updated 2026-11-02
Wp User Frontend - Security Vulnerability (CVE-2026-103962)
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'field_attr[required]' parameter in all versions up to, and including, 4.3.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The nonce check on the wpuf_get_child_cat AJAX action is not…
PLUGIN
Wp User Frontend
CVE-2026-103962
Risk Score
Threat Entry
Updated 2026-10-11
Wp User Frontend - Security Vulnerability (CVE-2026-96574)
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpuf_payment_method' parameter in all versions up to, and including, 4.3.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The bypass technique involves appending a valid gateway keyword such as 'bank' to the…
PLUGIN
Wp User Frontend
CVE-2026-96574
Risk Score
Threat Entry
Updated 2026-10-02
WP User Frontend - Security Vulnerability (CVE-2026-79618)
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.
PLUGIN
WP User Frontend
CVE-2026-79618
Risk Score
Threat Entry
Updated 2026-09-02
WP User Frontend - PHP Object Injection (CVE-2026-81283)
Subscriber PHP Object Injection in WP User Frontend
PLUGIN
WP User Frontend
CVE-2026-81283
Risk Score
Threat Entry
Updated 2026-07-09
Wp User Frontend - Security Vulnerability (CVE-2026-12418)
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.7 via the 'wpuf_files_data' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite the post_title, post_content, and post_excerpt of any arbitrary post on the site, including posts authored by administrators. Exploitation requires access to any WPUF post submission form; this is achievable by users with no WordPress role, as…
PLUGIN
Wp User Frontend
CVE-2026-12418
Risk Score
Threat Entry
Updated 2026-07-09
Wp User Frontend - Broken Access Control (CVE-2026-12406)
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to delete arbitrary media attachments whose post_author is 0, such as guest and registration-form uploads, via the wpuf_file_del AJAX action. This is exploitable by unauthenticated visitors on any site where a WPUF shortcode is rendered…
PLUGIN
Wp User Frontend
CVE-2026-12406
Risk Score
Threat Entry
Updated 2026-07-08
Wp User Frontend - Security Vulnerability (CVE-2026-5459)
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.1 via the payment_page() function due to missing validation on the 'user_id' user controlled key. This makes it possible for unauthenticated attackers to activate a free subscription pack for any user on the site, overwriting their existing paid subscription and causing loss of paid features.
PLUGIN
Wp User Frontend
CVE-2026-5459
Risk Score
Threat Entry
Updated 2026-06-29
WP User Frontend - Broken Access Control (CVE-2026-57334)
Unauthenticated Broken Access Control in WP User Frontend
PLUGIN
WP User Frontend
CVE-2026-57334
Risk Score
Threat Entry
Updated 2026-06-17
Wp User Frontend - PHP Object Injection (CVE-2026-5127)
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Deserialization of Untrusted Data in versions up to, and including, 4.3.1 This is due to insufficient input validation and type checking on the wpuf_files parameter during form submission, combined with unconditional deserialization via maybe_unserialize() when displaying post content. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary PHP objects, which can be leveraged to execute arbitrary code, delete arbitrary files, or perform other malicious…
PLUGIN
Wp User Frontend
CVE-2026-5127
Risk Score
Threat Entry
Updated 2026-10-26
Wp User Frontend - Broken Access Control (CVE-2026-42412)
Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP User Frontend: from n/a through 4.3.1.
PLUGIN
Wp User Frontend
CVE-2026-42412
Risk Score
Threat Entry
Updated 2026-06-17
Wp User Frontend - Broken Access Control (CVE-2026-32485)
Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through
PLUGIN
Wp User Frontend
CVE-2026-32485
Risk Score
Threat Entry
Updated 2026-06-17
Wp User Frontend - Broken Access Control (CVE-2026-24364)
Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through
PLUGIN
Wp User Frontend
CVE-2026-24364
Risk Score
Threat Entry
Updated 2026-06-17
Wp User Frontend - Broken Access Control (CVE-2026-2233)
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the draft_post() function in all versions up to, and including, 4.2.8. This makes it possible for unauthenticated attackers to modify arbitrary posts (e.g. unpublish published posts and overwrite the contents) via the 'post_id' parameter.
PLUGIN
Wp User Frontend
CVE-2026-2233
Risk Score
Threat Entry
Updated 2026-06-17
Wp User Frontend - Remote Code Execution (CVE-2026-1565)
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'WPUF_Admin_Settings::check_filetype_and_ext' function and in the 'Admin_Tools::check_filetype_and_ext' function in all versions up to, and including, 4.2.8. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
Wp User Frontend
CVE-2026-1565
Risk Score
Threat Entry
Updated 2026-06-17
Wp User Frontend - Broken Access Control (CVE-2025-14047)
The Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission – WP User Frontend plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'Frontend_Form_Ajax::submit_post' function in all versions up to, and including, 4.2.4. This makes it possible for unauthenticated attackers to delete attachment.
PLUGIN
Wp User Frontend
CVE-2025-14047
Risk Score
Threat Entry
Updated 2026-06-17
Wp User Frontend - Remote Code Execution (CVE-2025-58673)
Improper Control of Generation of Code ('Code Injection') vulnerability in weDevs WP User Frontend wp-user-frontend allows Code Injection.This issue affects WP User Frontend: from n/a through
PLUGIN
Wp User Frontend
CVE-2025-58673
Risk Score
Threat Entry
Updated 2026-06-17
Wp User Frontend - Broken Access Control (CVE-2025-58672)
Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through
PLUGIN
Wp User Frontend
CVE-2025-58672
Risk Score
Threat Entry
Updated 2026-06-17
Wp User Frontend - Broken Access Control (CVE-2023-45002)
Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 3.6.8.
PLUGIN
Wp User Frontend
CVE-2023-45002
Risk Score