User Frontend <= 4.3.13 - Reflected Cross-Site Scripting via 'field_attr[required]' Parameter

User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission · Cross-site scripting · CWE-79

AffectedUser Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission

FixNo fix listed yet.

PublishedOct 31, 07:46 · Wordfence

ScoredOct 31 · 6.1 · Wordfence

Exploit code publicNone known · checked 21:18 UTC

ExploitedNone known · CISA KEV checked 22:09 UTC

What we know

No known exploitation. CISA KEV, checked 22:09 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.

An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.

Someone has to open, click or run something first. CVSS: user interaction required.

Description

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'field_attr[required]' parameter in all versions up to, and including, 4.3.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The nonce check on the wpuf_get_child_cat AJAX action is not an effective security barrier because the wpuf_nonce value is publicly localized to every anonymous visitor of any page containing a WPUF shortcode, making it freely harvestable by an unauthenticated attacker.

From Wordfence

Affected and fixed versions

ProductAffectedFixed inUser Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submissionup to 4.3.13–

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

Other CVEs in User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission

All 2 →

8.8User Frontend <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post_content Parameter · CVE-2026-120070Oct 31 6.4User Frontend <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter · CVE-2026-96574Oct 10