WP User Frontend Pro EUVD-2026-93235

Exploitation targets the WP User Frontend Pro plugin (weDevs) at version 4.2.13 or earlier running on a WordPress site; the plugin must be installed and active. The vulnerability is unauthenticated (PR:N) but requires user interaction (UI:R) - a victim, typically a logged-in user or administrator, must click a crafted link or visit an attacker-influenced page for the injected script to execute. The limiting factors are this mandatory victim interaction and the requirement that the site actually runs the vulnerable plugin version; there is no server-side code execution and impact is confined to the browser context of the interacting user. The specific injectable parameter or feature is not detailed in the available data.

This is a moderate-severity, unauthenticated reflected/stored Cross-Site Scripting flaw (CWE-79) in the WP User Frontend Pro WordPress plugin (<= 4.2.13), reported by Patchstack with a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The network attack vector, low complexity, and no-privilege requirement (PR:N) make it reachable by anonymous attackers, and the scope change (S:C) reflects XSS executing in the victim's browser context rather than the server. The key limiting signal is UI:R - exploitation requires a victim (typically an authenticated admin or logged-in user) to interact with a malicious link or page, which is why confidentiality, integrity, and availability impacts are all rated Low rather than High. No EPSS score, CISA KEV listing, or public POC was provided in the input: by precision rules this is 'no public exploit identified at time of analysis,' meaning there is no evidence of active exploitation. Net assessment: a real but not emergency priority - patch on a normal cadence. The 7.1 score is driven largely by the scope change inherent to XSS, not by a wormable or server-compromising condition; the mandatory user interaction and limited CIA impact keep real-world risk moderate rather than critical. Missing data to note explicitly: EPSS probability is absent (cannot gauge likelihood statistically), and whether this is reflected vs. stored XSS is not specified in the description - verify with the Patchstack advisory, as stored XSS would raise practical risk.

An attacker crafts a malicious URL or form input targeting an unauthenticated, improperly sanitized parameter in WP User Frontend Pro and lures a logged-in site administrator or user into clicking it (UI:R). When the page renders, the injected JavaScript executes in the victim's browser session, allowing session/cookie theft, admin-action forgery, or defacement. No public exploit code was identified at time of analysis.