WordPress Plugin Vulnerabilities

WP User Frontend < 4.3.14 - Reflected XSS via 'field_attr' Parameter

Description

The plugin does not sanitise and escape some user-supplied values before reflecting them into HTML attributes in a publicly reachable AJAX response, leading to Reflected Cross-Site Scripting. The affected action is gated by an anonymous nonce that only validates for logged-out requests, so the payload executes against logged-out visitors rather than authenticated users.

Proof of Concept

Affects Plugins

Plugin icon
wp-user-frontend
Fixed in 4.3.14

References

CVE
CVE-2026-115277

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
4.7 (medium)

Miscellaneous

Original Researcher
Jasper Weijts
Submitter
Jasper Weijts (Onvio Pentesting)
Submitter website
https://www.onvio.nl
Verified
Yes
WPVDB ID
b3f0ca09-1c63-4a34-90bf-7b220fcec556

Timeline

Publicly Published
2026-10-28 (about 2 days ago)
Added
2026-10-28 (about 1 day ago)
Last Updated
2026-10-28 (about 1 day ago)

Other

Published
Title
Published
2026-10-15
Title
HivePress < 1.8.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'message' Attribute of the hivepress_user_login_form Shortcode
Published
2022-02-25
Title
Contact Form X < 2.4.1 - Reflected Cross-Site Scripting
Published
2023-04-24
Title
PushAssist <= 3.0.8 - Reflected Cross-Site Scripting
Published
2025-08-27
Title
PDF for Elementor Forms + Drag And Drop Template Builder < 6.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-11-20
Title
Lazy load videos and sticky control <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting