WP User Frontend EUVD-2026-114651

Exploitation targets the 'field_attr[required]' parameter handled by the wpuf_get_child_cat AJAX action; the normally-protective nonce check is ineffective because wpuf_nonce is publicly localized to every anonymous visitor of any page containing a WPUF shortcode, so a prerequisite is that the site has at least one page rendering a WPUF shortcode from which the attacker can harvest that nonce. The attacker needs no authentication (PR:N). The principal limiting factor is required user interaction (UI:R): a victim must be tricked into clicking an attacker-crafted link for the reflected script to execute, and impact is bounded to the victim's browser session (C:L/I:L, no availability impact). Affected: all versions up to and including 4.3.13.

This is a moderate-severity reflected XSS (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) rather than a top-priority emergency, which is consistent with the 'this_month' decision label. The signals are coherent and point to limited real-world urgency: the vector is network-reachable and low-complexity with no privileges needed (PR:N, so unauthenticated), but exploitation is gated on user interaction (UI:R) - the victim must be lured into clicking an attacker-crafted link - and impact is only partial confidentiality and integrity (C:L/I:L) with no availability effect. No EPSS score and no CISA KEV status were provided in the input, and no exploitation activity is claimed; absence of those is not evidence of safety but means there is no signal of widespread or automated exploitation here. No public exploit identified at time of analysis - the references are a Wordfence advisory and WordPress plugin source/changeset links, not a published PoC. Notably, the description makes a specific and credible claim that the wpuf_get_child_cat AJAX nonce is not a real barrier because wpuf_nonce is publicly localized to anonymous visitors on any page bearing a WPUF shortcode, meaning the nonce is freely harvestable and does not raise attack complexity - this supports AC:L. Overall: a genuine, straightforward reflected XSS worth patching within the normal cycle, but not a drop-everything issue given the user-interaction requirement and limited impact.

An unauthenticated attacker first loads any public page of the target site that contains a WPUF shortcode to harvest the publicly localized wpuf_nonce, then crafts a malicious link to the wpuf_get_child_cat AJAX action with a script payload in the 'field_attr[required]' parameter. When a logged-in user (e.g., an administrator) is tricked into clicking the link, the unsanitized value is reflected and the script executes in their browser session. No public exploit identified at time of analysis, though the description documents the nonce-bypass mechanism in detail.