WP User Frontend EUVD-2026-113725

Exploitation requires the WP User Frontend plugin at a version before 4.3.14 and a victim who is a logged-out visitor: the attacker must get that visitor to follow a crafted link so the user-supplied value is reflected unescaped into an HTML attribute in the public AJAX response (UI:R). The key limiting factor is the anonymous-nonce design - the affected action's nonce only validates for logged-out requests, so authenticated users (including admins) are not the targets and cannot be used to pivot to admin-context script execution; this both enables the unauthenticated (PR:N) path and caps the impact to the logged-out audience. Reflected XSS is also non-persistent, so each victim must be individually induced to trigger the crafted request. Updating to 4.3.14 is the vendor-provided fix.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N, base 4.7 Medium) describes a network-reachable, low-complexity, unauthenticated reflected XSS whose execution requires user interaction (victim must follow a crafted link), with a scope change (S:C) reflecting that the injected script runs in the victim's browser context rather than the server. All severity signals point the same direction and are mutually consistent: EPSS is low at 0.16% (5th percentile), there is no CISA KEV listing, and the CISA SSVC read is Exploitation:none / Automatable:no / Technical Impact:partial. The vuln.today decision label is 'this_month' - a routine patch cadence, not act_now/emergency. The one notable nuance from the description is that the vulnerable AJAX action is gated by an anonymous nonce that only validates for logged-out requests, so the payload executes specifically against logged-out visitors rather than authenticated users/admins - this narrows the victim population and reduces the value of the bug for privilege escalation or admin account takeover, which is the usual high-impact XSS payoff. No KEV, no confirmed working exploit code, low EPSS, and non-automatable SSVC together indicate a low real-world exploitation likelihood; the vector's PR:N is credible given the logged-out nonce gating. Treat as a standard-cadence patch, not a drop-everything item.

An attacker crafts a URL containing a malicious payload in the user-supplied value that the plugin's publicly reachable AJAX endpoint reflects unescaped into an HTML attribute, then lures a logged-out site visitor into clicking it (e.g., via phishing or a malicious link). Because the anonymous nonce only validates for logged-out requests, the script executes in the visitor's browser session against the vulnerable site's origin. No public working exploit code is identified at time of analysis; a WPScan advisory describes the vulnerability.