CVE-2026-115277: WP User Frontend < 4.3.14 - Reflected XSS via 'field_attr' Parameter
The User Frontend WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before reflecting them into HTML attributes in a publicly reachable AJAX response, leading to Reflected Cross-Site Scripting. The affected action is gated by an anonymous nonce that only validates for logged-out requests, so the payload executes against logged-out visitors rather than authenticated users.
Event History
Frequently Asked Questions
Who can be affected by successful exploitation?
The vulnerable AJAX action is restricted by an anonymous nonce that validates only for logged-out requests. As a result, the reflected script payload executes in the browser of logged-out visitors rather than authenticated users.
What does an attacker need to exploit this issue?
The issue is reachable over the network with low attack complexity and requires no privileges, but it does require user interaction. An attacker must cause a logged-out visitor to submit or follow a request containing a malicious field_attr value.
Are current plugin versions affected?
Versions before 4.3.14 are affected. Updating WP User Frontend to version 4.3.14 or later removes the affected version range described here.