WP Front End Profile <= 0.2.1 - Privilege Escalation & Stored Cross-Site Scripting (XSS)

Description

It is possible to modify a POST request to overwrite user meta including 'wp_capabilities' and 'wp_user_level' which results in a privilege escalation vulnerability.

User input is not sanitised or escaped on output resulting in a stored XSS vulnerability.

Timeline:

2016-09-12: Vulnerability found
2016-09-12: Reported to vendor
2016-09-12: Vendor responded
2016-09-14: Vendor released a fixed version (0.2.2)
2016-09-14: Public disclosure