← back to popular plugins
wordfence / plugin · wp-user-frontend
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
wp-user-frontend
total installs
20,000
total vulns
27
critical
0
high
6
medium
21
low
0
latest vuln
—
patched
27
unpatched
0
avg time to patch
—
vulnerabilities
(27)
User Frontend <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter
medium
✓ patched
cve id
CVE-2026-96574 ↗
cvss score
6.4
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Oct 9, 2026
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpuf_payment_method' parameter in all versions up to, and including, 4.3.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The bypass technique involves appending a valid gateway keyword such as 'bank' to the HTML payload, causing sanitize_text_field() to yield only the keyword for routing purposes while the full malicious raw value is stored and later rendered unescaped.
User Frontend <= 4.3.11 - Authenticated (Subscriber+) Subscription-Gated Post Creation
medium
✓ patched
cve id
CVE-2026-79618 ↗
cvss score
4.3
cwe
CWE-602: Client-Side Enforcement of Server-Side Security
published
Sep 28, 2026
The User Frontend plugin for WordPress is vulnerable to Payment Bypass in all versions up to, and including, 4.3.11. This is due to missing server-side validation of submission state, allowing a client-supplied `wpuf_form_status` field (or the absence of `post_id`) to bypass the subscription-pack gate in the post-creation handler. This makes it possible for authenticated attackers, with subscriber-level access and above, to create and publish posts through subscription-gated forms without purchasing the required subscription pack.
User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation
high
✓ patched
cve id
CVE-2026-75823 ↗
cvss score
7.3
cwe
CWE-269: Improper Privilege Management
published
Sep 28, 2026
The User Frontend plugin for WordPress is vulnerable to Privilege Escalation in versions 3.5.29 through 4.3.11. This is due to insufficient restriction on the capabilities a user may grant themselves. This makes it possible for unauthenticated attackers to elevate their privileges beyond those intended for their role.
User Frontend 2.5.8 - 4.3.11 - Missing Authorization
medium
✓ patched
The User Frontend plugin for WordPress is vulnerable to unauthorized access in versions 2.5.8 through 4.3.11. This is due to a missing capability check on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action.
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.11 - Authenticated (Subscriber+) Arbitrary File Deletion
high
✓ patched
cve id
CVE-2026-95525 ↗
cvss score
8.1
cwe
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
published
Sep 23, 2026
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient file path validation in the [function_or_param] function in all versions up to, and including, 4.3.11. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.11 - Unauthenticated Unauthorized User Registration
medium
✓ patched
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Authorization Bypass in all versions up to, and including, 4.3.11. This is due to a missing check for the `users_can_register` site option in the frontend registration handler, allowing unauthenticated POST requests to the init-hooked handler to create accounts regardless of the site's registration setting. This makes it possible for unauthenticated attackers to register new user accounts on sites where user registration has been disabled by the administrator.
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.11 - Authenticated (Subscriber+) Subscription Gate Bypass on Post Submission
medium
✓ patched
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Authorization Bypass in all versions up to, and including, 4.3.11. This is due to missing validation that the caller-supplied form_id refers to an actual wpuf_forms post, and server-side submission status being determined from a client-controlled field rather than post meta. This makes it possible for authenticated attackers, with subscriber-level access and above, to create posts while bypassing subscription and payment gates by supplying a non-form post ID as the form_id parameter, or by manipulating the submission-status field to skip the posting-quota check entirely.
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.10 - Authenticated (Subscriber+) PHP Object Injection
high
✓ patched
cve id
CVE-2026-81283 ↗
cvss score
7.5
cwe
CWE-502: Deserialization of Untrusted Data
published
Sep 1, 2026
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.3.10. This is due to deserialization of untrusted input. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
User Frontend <= 4.3.10 - Missing Authorization to Unauthenticated Post Creation
medium
✓ patched
The User Frontend plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.10. This is due to missing server-side enforcement of the form's subscription gate in the AJAX post-submission handler, which only checked the gate at render time. This makes it possible for unauthenticated attackers to create posts through subscription-gated frontend forms without purchasing a subscription, bypassing payment requirements entirely.
User Frontend <= 4.3.10 - Authenticated (Subscriber+) PHP Object Injection
high
✓ patched
cve id
CVE-2026-19116 ↗
cvss score
7.5
cwe
CWE-502: Deserialization of Untrusted Data
published
Aug 31, 2026
The User Frontend plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.3.10. This is due to deserialization of untrusted input. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission < 4.3.10 - Unauthenticated Information Exposure
medium
✓ patched
cve id
CVE-2026-14567 ↗
cvss score
5.3
cwe
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
published
Aug 28, 2026
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to 4.3.10. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission < 4.3.10 - Authenticated (Editor+) PHP Object Injection
medium
✓ patched
cve id
CVE-2026-14558 ↗
cvss score
6.6
cwe
CWE-502: Deserialization of Untrusted Data
published
Aug 28, 2026
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 4.3.10. This is due to deserialization of untrusted input. This makes it possible for authenticated attackers, with editor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Modification via 'wpuf_files_data' Parameter
medium
✓ patched
cve id
CVE-2026-12418 ↗
cvss score
5.3
cwe
CWE-639: Authorization Bypass Through User-Controlled Key
published
Jul 8, 2026
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.7 via the 'wpuf_files_data' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite the post_title, post_content, and post_excerpt of any arbitrary post on the site, including posts authored by administrators. Exploitation requires access to any WPUF post submission form; this is achievable by users with no WordPress role, as the wpuf_submit_post AJAX action is gated only by a nonce with no capability check for the downstream post-edit operation.
User Frontend <= 4.3.7 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attach_id' Parameter
medium
✓ patched
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to delete arbitrary media attachments whose post_author is 0, such as guest and registration-form uploads, via the wpuf_file_del AJAX action. This is exploitable by unauthenticated visitors on any site where a WPUF shortcode is rendered on a front-end page, as this causes the valid wpuf_nonce value to be localized into publicly accessible JavaScript objects (wpuf_upload and wpuf_frontend), satisfying the sole access control gate. CVE-2026-14568 is a duplicate of this.
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Subscription Overwrite
medium
✓ patched
cve id
CVE-2026-5459 ↗
cvss score
5.3
cwe
CWE-639: Authorization Bypass Through User-Controlled Key
published
Jul 7, 2026
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.1 via the payment_page() function due to missing validation on the 'user_id' user controlled key. This makes it possible for unauthenticated attackers to activate a free subscription pack for any user on the site, overwriting their existing paid subscription and causing loss of paid features.
User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration < 4.3.8 - Missing Authorization to Unauthenticated Media Attachment Deletion
medium
✓ patched
The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to 4.3.8 (exclusive). This makes it possible for unauthenticated attackers to delete arbitrary attachment files.
User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration <= 4.3.7 - Missing Authorization
medium
✓ patched
The User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.3.7. This makes it possible for unauthenticated attackers to perform an unauthorized action.
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.2 - Missing Authorization to Authenticated (Subscriber+) Subscription Pack Cancellation
medium
✓ patched
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the user_subscription_cancel() function in all versions up to, and including, 4.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to cancel any user's subscription pack, including administrators.
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Authenticated (Subscriber+) PHP Object Injection
high
✓ patched
cve id
CVE-2026-5127 ↗
cvss score
8.8
cwe
CWE-502: Deserialization of Untrusted Data
published
May 7, 2026
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Deserialization of Untrusted Data in versions up to, and including, 4.3.1 This is due to insufficient input validation and type checking on the wpuf_files parameter during form submission, combined with unconditional deserialization via maybe_unserialize() when displaying post content. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary PHP objects, which can be leveraged to execute arbitrary code, delete arbitrary files, or perform other malicious actions if a POP chain is present on the target system.
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Missing Authorization
medium
✓ patched
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.3.1. This makes it possible for unauthenticated attackers to perform an unauthorized action.
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Missing Authorization
medium
✓ patched
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 4.2.8. This makes it possible for unauthenticated attackers to perform an unauthorized action.
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Post Modification via 'post_id' Parameter
medium
✓ patched
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the draft_post() function in all versions up to, and including, 4.2.8. This makes it possible for unauthenticated attackers to modify arbitrary posts (e.g. unpublish published posts and overwrite the contents) via the 'post_id' parameter.
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.5 - Missing Authorization
medium
✓ patched
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 4.2.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Authenticated (Author+) Arbitrary File Upload
high
✓ patched
cve id
CVE-2026-1565 ↗
cvss score
8.8
cwe
CWE-434: Unrestricted Upload of File with Dangerous Type
published
Feb 26, 2026
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'WPUF_Admin_Settings::check_filetype_and_ext' function and in the 'Admin_Tools::check_filetype_and_ext' function in all versions up to, and including, 4.2.8. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
WP User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion
medium
✓ patched
The Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission – WP User Frontend plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'Frontend_Form_Ajax::submit_post' function in all versions up to, and including, 4.2.4. This makes it possible for unauthenticated attackers to delete attachment.
WP User Frontend <= 4.1.12 - Missing Authorization
medium
✓ patched
The WP User Frontend plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.1.12. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.
WP User Frontend <= 4.1.12 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
medium
✓ patched
cve id
CVE-2025-58673 ↗
cvss score
5.4
cwe
CWE-94: Improper Control of Generation of Code ('Code Injection')
published
Sep 22, 2025
The The Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission – WP User Frontend plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.1.12. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.