User Frontend vulnerabilities
We track 3 vulnerabilities in User Frontend products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 30, 2026.
Latest User Frontend vulnerabilities
- 7.4 High severity
User Frontend: Improper Privilege Management
The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP buil
- 8.8 High severity
User Frontend: Deserialization of Untrusted Data
The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform
- 7.2 High severity
User Frontend: Deserialization of Untrusted Data
The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects,