User Frontend Membership User Registration User Profile User Directory Content Restriction With Frontend Post Submission
Monthly
Stored cross-site scripting in the WP User Frontend WordPress plugin (all versions up to and including 4.3.12) allows any authenticated user with subscriber-level access or higher to persist arbitrary JavaScript that executes when a privileged user - typically an administrator - opens the affected transactions page. The root cause is insufficient sanitization and output escaping of the 'wpuf_payment_method' parameter: attackers bypass sanitize_text_field() by appending a valid gateway keyword such as 'bank' to the HTML payload, so the filter returns only the keyword for gateway routing while the full raw malicious value is stored and later rendered unescaped in the admin transactions list. Wordfence reported the issue with a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N); no public exploit code was identified at time of analysis, and there is no confirmed evidence of active exploitation (no CISA KEV listing).
Stored cross-site scripting in the WP User Frontend WordPress plugin (all versions up to and including 4.3.12) allows any authenticated user with subscriber-level access or higher to persist arbitrary JavaScript that executes when a privileged user - typically an administrator - opens the affected transactions page. The root cause is insufficient sanitization and output escaping of the 'wpuf_payment_method' parameter: attackers bypass sanitize_text_field() by appending a valid gateway keyword such as 'bank' to the HTML payload, so the filter returns only the keyword for gateway routing while the full raw malicious value is stored and later rendered unescaped in the admin transactions list. Wordfence reported the issue with a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N); no public exploit code was identified at time of analysis, and there is no confirmed evidence of active exploitation (no CISA KEV listing).