WordPress plugin
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical2
- High12
- Medium29
- Low0
All User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Unauthenticated Stored Cross-Site Scripting via Taxonomy Field Text-Input ≤4.3.13Update to 4.3.14 | CVE-2026-109214 | |
| High8.8 | Authenticated (Subscriber+) Privilege Escalation via post_content Parameter ≤4.3.13Update to 4.3.14 | CVE-2026-120070 | |
| High7.3 | 4.3.11 - Unauthenticated Privilege Escalation 3.5.29 – 4.3.11Update to 4.3.12 | CVE-2026-75823 | |
| High8.1 | Authenticated (Subscriber+) Arbitrary File Deletion ≤4.3.11Update to 4.3.12 | CVE-2026-95525 | |
| High7.5 | Authenticated (Subscriber+) PHP Object Injection ≤4.3.10Update to 4.3.11 | CVE-2026-81283 | |
| High7.5 | Authenticated (Subscriber+) PHP Object Injection ≤4.3.10Update to 4.3.11 | CVE-2026-19116 | |
| High8.8 | Authenticated (Subscriber+) PHP Object Injection ≤4.3.1Update to 4.3.2 | CVE-2026-5127 | |
| High8.8 | Authenticated (Author+) Arbitrary File Upload ≤4.2.8Update to 4.2.9 | CVE-2026-1565 | |
| Critical9.1 | Authenticated (Administrator+) SQL Injection ≤4.0.7Update to 4.0.8 | CVE-2024-38693 | |
| High8.8 | Authenticated (Author+) Privilege Escalation ≤3.6.5Update to 3.6.6 | CVE-2023-47682 | |
| High8.1 | Privilege Escalation ≤3.5.28Update to 3.5.29 | CVE-2021-24649 | |
| High8.8 | SQL Injection & Reflected Cross-Site Scripting ≤3.5.25Update to 3.5.26 | CVE-2021-25076 | |
| High7.2 | Authenticated (Admin+) SQL Injection <3.5.25Update to 3.5.25 | — | |
| Critical9.8 | Arbitrary File Upload <2.3.11Update to 2.3.11 | — |
- High7.2Unauthenticated Stored Cross-Site Scripting via Taxonomy Field Text-Input
≤4.3.13Update to 4.3.14
- High8.8Authenticated (Subscriber+) Privilege Escalation via post_content Parameter
≤4.3.13Update to 4.3.14
- High7.34.3.11 - Unauthenticated Privilege Escalation
3.5.29 – 4.3.11Update to 4.3.12
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
≤4.3.11Update to 4.3.12
- High7.5Authenticated (Subscriber+) PHP Object Injection
≤4.3.10Update to 4.3.11
- High7.5Authenticated (Subscriber+) PHP Object Injection
≤4.3.10Update to 4.3.11
- High8.8Authenticated (Subscriber+) PHP Object Injection
≤4.3.1Update to 4.3.2
- High8.8Authenticated (Author+) Arbitrary File Upload
≤4.2.8Update to 4.2.9
- Critical9.1Authenticated (Administrator+) SQL Injection
≤4.0.7Update to 4.0.8
- High8.8Authenticated (Author+) Privilege Escalation
≤3.6.5Update to 3.6.6
- High8.1Privilege Escalation
≤3.5.28Update to 3.5.29
- High8.8SQL Injection & Reflected Cross-Site Scripting
≤3.5.25Update to 3.5.26
- High7.2Authenticated (Admin+) SQL Injection
<3.5.25Update to 3.5.25
- Critical9.8Arbitrary File Upload
<2.3.11Update to 2.3.11
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission: common questions
Does User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission have known vulnerabilities?
Yes. VulnCrest Radar lists 43 known vulnerabilities in User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission: 2 critical, 12 high, 29 medium. At least one is not fixed in the latest version.
How do I check which version of User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission vulnerability?
CVE-2026-109214, published Nov 6, 2026: User Frontend <= 4.3.13 - Unauthenticated Stored Cross-Site Scripting via Taxonomy Field Text-Input. Severity: High (CVSS 7.2).
Is any User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission vulnerability listed in CISA KEV?
No. None of the known User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission vulnerabilities is currently listed in the CISA KEV catalog.