User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission

Information

Software Type Plugin
Software Slug wp-user-frontend (view on wordpress.org)
Software Status Active
Software Author wedevs
Software Website wordpress.org
Software Downloads 2,004,323
Software Active Installs 20,000
Software Record Last Updated October 16, 2026

Showing 1-20 of 37 Vulnerabilities

Submit a Vulnerability
User Frontend <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter
6.4
CVE-2026-96574
Oct 9, 2026
Researcher: Tarcísio Luchesi De Almeida Silva (Poystick)
User Frontend <= 4.3.11 - Authenticated (Subscriber+) Subscription-Gated Post Creation
4.3
CVE-2026-79618
Sep 28, 2026
Researcher: Erwan LR
User Frontend 2.5.8 - 4.3.11 - Missing Authorization
5.3
CVE-2026-75824
Sep 28, 2026
Researcher: Murad Akhmedov
User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation
7.3
CVE-2026-75823
Sep 28, 2026
Researcher: Murad Akhmedov
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.11 - Authenticated (Subscriber+) Arbitrary File Deletion
8.1
CVE-2026-95525
Sep 23, 2026
Researcher: Ananda Dhakal
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.11 - Unauthenticated Unauthorized User Registration
5.3
CVE-2026-95524
Sep 23, 2026
Researcher: Ananda Dhakal
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.11 - Authenticated (Subscriber+) Subscription Gate Bypass on Post Submission
6.3
CVE-2026-95523
Sep 23, 2026
Researcher: Ananda Dhakal
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.10 - Authenticated (Subscriber+) PHP Object Injection
7.5
CVE-2026-81283
Sep 1, 2026
Researcher: VanTastic
User Frontend <= 4.3.10 - Authenticated (Subscriber+) PHP Object Injection
7.5
CVE-2026-19116
Aug 31, 2026
Researcher: Erwan LR
User Frontend <= 4.3.10 - Missing Authorization to Unauthenticated Post Creation
5.3
CVE-2026-17563
Aug 31, 2026
Researcher: Charles Vosburgh
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission < 4.3.10 - Unauthenticated Information Exposure
5.3
CVE-2026-14567
Aug 28, 2026
Researcher: Revanth Hari Narayana Matte
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission < 4.3.10 - Authenticated (Editor+) PHP Object Injection
6.6
CVE-2026-14558
Aug 28, 2026
Researcher: Hijun Kim
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Modification via 'wpuf_files_data' Parameter
5.3
CVE-2026-12418
Jul 8, 2026
Researcher: Kim ChanYeop
User Frontend <= 4.3.7 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attach_id' Parameter
5.3
CVE-2026-12406
Jul 8, 2026
Researcher: mrvincere
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Subscription Overwrite
5.3
CVE-2026-5459
Jul 7, 2026
Researcher: Yuto Hyakumoto
User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration < 4.3.8 - Missing Authorization to Unauthenticated Media Attachment Deletion
5.3
CVE-2026-14568
Jul 6, 2026
Researcher: kimsunghoon
User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration <= 4.3.7 - Missing Authorization
5.3
CVE-2026-57334
Jun 29, 2026
Researchers:
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.2 - Missing Authorization to Authenticated (Subscriber+) Subscription Pack Cancellation
4.3
CVE-2026-4058
Jun 8, 2026
Researcher: Supakiad S. (m3ez)
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Authenticated (Subscriber+) PHP Object Injection
8.8
CVE-2026-5127
May 7, 2026
Researcher: d.v4n_s3c
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Missing Authorization
5.3
CVE-2026-42412
Apr 27, 2026
Researcher: Sajjad Haqi
Title Status CVE ID CVSS Researchers Date
User Frontend <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter Patched CVE-2026-96574 6.4 Tarcísio Luchesi De Almeida Silva (Poystick) October 9, 2026
User Frontend <= 4.3.11 - Authenticated (Subscriber+) Subscription-Gated Post Creation Patched CVE-2026-79618 4.3 Erwan LR September 28, 2026
User Frontend 2.5.8 - 4.3.11 - Missing Authorization Patched CVE-2026-75824 5.3 Murad Akhmedov September 28, 2026
User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation Patched CVE-2026-75823 7.3 Murad Akhmedov September 28, 2026
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.11 - Authenticated (Subscriber+) Arbitrary File Deletion Patched CVE-2026-95525 8.1 Ananda Dhakal September 23, 2026
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.11 - Unauthenticated Unauthorized User Registration Patched CVE-2026-95524 5.3 Ananda Dhakal September 23, 2026
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.11 - Authenticated (Subscriber+) Subscription Gate Bypass on Post Submission Patched CVE-2026-95523 6.3 Ananda Dhakal September 23, 2026
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.10 - Authenticated (Subscriber+) PHP Object Injection Patched CVE-2026-81283 7.5 VanTastic September 1, 2026
User Frontend <= 4.3.10 - Authenticated (Subscriber+) PHP Object Injection Patched CVE-2026-19116 7.5 Erwan LR August 31, 2026
User Frontend <= 4.3.10 - Missing Authorization to Unauthenticated Post Creation Patched CVE-2026-17563 5.3 Charles Vosburgh August 31, 2026
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission < 4.3.10 - Unauthenticated Information Exposure Patched CVE-2026-14567 5.3 Revanth Hari Narayana Matte August 28, 2026
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission < 4.3.10 - Authenticated (Editor+) PHP Object Injection Patched CVE-2026-14558 6.6 Hijun Kim August 28, 2026
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Modification via 'wpuf_files_data' Parameter Patched CVE-2026-12418 5.3 Kim ChanYeop July 8, 2026
User Frontend <= 4.3.7 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attach_id' Parameter Patched CVE-2026-12406 5.3 mrvincere July 8, 2026
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Subscription Overwrite Patched CVE-2026-5459 5.3 Yuto Hyakumoto July 7, 2026
User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration < 4.3.8 - Missing Authorization to Unauthenticated Media Attachment Deletion Patched CVE-2026-14568 5.3 kimsunghoon July 6, 2026
User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration <= 4.3.7 - Missing Authorization Patched CVE-2026-57334 5.3 June 29, 2026
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.2 - Missing Authorization to Authenticated (Subscriber+) Subscription Pack Cancellation Patched CVE-2026-4058 4.3 Supakiad S. (m3ez) June 8, 2026
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Authenticated (Subscriber+) PHP Object Injection Patched CVE-2026-5127 8.8 d.v4n_s3c May 7, 2026
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Missing Authorization Patched CVE-2026-42412 5.3 Sajjad Haqi April 27, 2026

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation