User Frontend <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter

User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission · Cross-site scripting · CWE-79

AffectedUser Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission

FixNo fix listed yet.

PublishedOct 10, 06:40 · Wordfence

ScoredOct 10 · 6.4 · Wordfence

Exploit code publicNone known · checked 21:18 UTC

ExploitedNone known · CISA KEV checked 22:06 UTC

What we know

No known exploitation. CISA KEV, checked 22:06 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.

An attacker needs network access and an account. CVSS: network, low privileges.

Description

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpuf_payment_method' parameter in all versions up to, and including, 4.3.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The bypass technique involves appending a valid gateway keyword such as 'bank' to the HTML payload, causing sanitize_text_field() to yield only the keyword for routing purposes while the full malicious raw value is stored and later rendered unescaped.

From Wordfence

Affected and fixed versions

ProductAffectedFixed inUser Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submissionup to 4.3.12–

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

Other CVEs in User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission

All 2 →

8.8User Frontend <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post_content Parameter · CVE-2026-120070Oct 31 6.1User Frontend <= 4.3.13 - Reflected Cross-Site Scripting via 'field_attr[required]' Parameter · CVE-2026-103962Oct 31