CVE-2026-103962: User Frontend <= 4.3.13 - Reflected Cross-Site Scripting via 'field_attr[required]' Parameter

Q: Who is exposed to this issue?

WordPress sites running User Frontend versions through 4.3.13 are affected. The publicly exposed AJAX nonce can be obtained by unauthenticated visitors from pages that contain a WPUF shortcode.

Q: What does an attacker need to exploit it?

No account or prior privileges are required. An attacker needs to persuade a victim to perform an action such as clicking a crafted link, causing injected script to execute in the victim's browser.

Q: Does the nonce check prevent unauthenticated exploitation?

No. The wpuf_nonce value is publicly localized to anonymous visitors on pages containing a WPUF shortcode, so an unauthenticated attacker can harvest it.

Q: How can I determine whether my site may be affected?

Check whether the User Frontend plugin is installed at version 4.3.13 or earlier, and whether your site exposes pages containing a WPUF shortcode. Such pages make the nonce referenced by the affected AJAX action publicly available.

Published Oct 31, 2026

Updated

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'fieldattr[required]' parameter in all versions up to, and including, 4.3.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The nonce check on the wpufgetchildcat AJAX action is not an effective security barrier because the wpufnonce value is publicly localized to every anonymous visitor of any page containing a WPUF shortcode, making it freely harvestable by an unauthenticated attacker.

Event History

Oct 31, 2026

CVE Published

via MITRE·07:46 AM

Data Sourced

via MITRE·07:46 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

WordPress sites running User Frontend versions through 4.3.13 are affected. The publicly exposed AJAX nonce can be obtained by unauthenticated visitors from pages that contain a WPUF shortcode.

What does an attacker need to exploit it?

No account or prior privileges are required. An attacker needs to persuade a victim to perform an action such as clicking a crafted link, causing injected script to execute in the victim's browser.

Does the nonce check prevent unauthenticated exploitation?

No. The wpuf_nonce value is publicly localized to anonymous visitors on pages containing a WPUF shortcode, so an unauthenticated attacker can harvest it.

How can I determine whether my site may be affected?

Check whether the User Frontend plugin is installed at version 4.3.13 or earlier, and whether your site exposes pages containing a WPUF shortcode. Such pages make the nonce referenced by the affected AJAX action publicly available.

CVE-2026-103962: User Frontend <= 4.3.13 - Reflected Cross-Site Scripting via 'field_attr[required]' Parameter

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Does the nonce check prevent unauthenticated exploitation?

How can I determine whether my site may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Does the nonce check prevent unauthenticated exploitation?

How can I determine whether my site may be affected?