WordPress plugin · wp-user-frontend
Is User Frontend safe?
Safe on 4.3.14 or newer.
The current version, 4.3.14, is past every affected range on record (31 of 32 records list one; 1 doesn’t, so check it below). Keep it updated and you’re clear of them.
- Flaws on record
- 32
- High or critical
- 11
- Exploited
- none
- Current version
- 4.3.14
- Last updated
- Oct 28, 2026
- Active installs
- 20,000+
Every recorded flaw
- Oct 10, 2026The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnCVE-2026-96574 · affects up to 4.3.12 · reported by WordfenceMedium 6.4
- Oct 2, 2026WP User Frontend: Does not enforce its subscription-purchase requirement in one of its post-creation handlersCVE-2026-79618 · fixed in 4.3.12 · reported by WPScanMedium 4.3
- Sep 30, 2026User Frontend: Does not check whether the site allows user registration before creating an accountCVE-2026-75824 · fixed in 4.3.12 · reported by WPScanMedium 5.3
- Sep 30, 2026User Frontend: Does not prevent tampering with the role assigned by its registration formCVE-2026-75823 · fixed in 4.3.12 · reported by WPScanHigh 7.4
- Sep 23, 2026Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions.CVE-2026-95525 · affects up to 4.3.11 · reported by PatchstackMedium 6.5
- Sep 23, 2026Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.CVE-2026-95524 · affects up to 4.3.11 · reported by PatchstackMedium 5.3
- Sep 23, 2026Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.CVE-2026-95523 · affects up to 4.3.11 · reported by PatchstackMedium 6.5
- Sep 2, 2026User Frontend: Does not enforce its subscription-purchase requirementCVE-2026-17563 · fixed in 4.3.11 · reported by WPScanMedium 5.3
- Sep 2, 2026Subscriber PHP Object Injection in WP User Frontend <= 4.3.10 versions.CVE-2026-81283 · affects up to 4.3.10 · reported by PatchstackHigh 8.8
- Sep 2, 2026User Frontend: Does not prevent user-supplied field values from being deserializedCVE-2026-19116 · fixed in 4.3.11 · reported by WPScanHigh 8.8
- Aug 28, 2026User Frontend: Does not restrict access to its user directory search endpointCVE-2026-14567 · fixed in 4.3.10 · reported by WPScanMedium 5.3
- Aug 28, 2026User Frontend: Does not properly validate field type definitions and deserialises user-controlled post metadataCVE-2026-14558 · fixed in 4.3.10 · reported by WPScanHigh 7.2
- Jul 9, 2026User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration: Insecure Direct Object ReferenceCVE-2026-12418 · affects up to 4.3.7 · reported by WordfenceMedium 5.3
- Jul 9, 2026User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration: Authorization bypassCVE-2026-12406 · affects up to 4.3.7 · reported by WordfenceMedium 5.3
- Jul 8, 2026User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration: Insecure Direct Object ReferenceCVE-2026-5459 · affects up to 4.3.1 · reported by WordfenceMedium 5.3
- Jun 29, 2026Unauthenticated Broken Access Control in WP User Frontend <= 4.3.7 versions.CVE-2026-57334 · reported by PatchstackMedium 6.5
- Jun 9, 2026User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration: Unauthorized modification of dataCVE-2026-4058 · affects up to 4.3.2 · reported by WordfenceMedium 4.3
- May 8, 2026User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration: Deserialization of Untrusted DataCVE-2026-5127 · affects up to 4.3.1 · reported by WordfenceHigh 8.8
- Apr 29, 2026WP User Frontend: Missing AuthorizationCVE-2026-42412 · affects up to 4.3.1 · reported by PatchstackMedium 6.5
- Mar 25, 2026WP User Frontend: Missing AuthorizationCVE-2026-32485 · affects up to 4.2.8 · reported by PatchstackHigh 7.5
- Mar 25, 2026WP User Frontend: Missing AuthorizationCVE-2026-24364 · affects up to 4.2.5 · reported by PatchstackMedium 6.5
- Mar 16, 2026User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration: Unauthorized modification of dataCVE-2026-2233 · affects up to 4.2.8 · reported by WordfenceMedium 5.3
- Feb 26, 2026User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration: Arbitrary file uploadsCVE-2026-1565 · affects up to 4.2.8 · reported by WordfenceHigh 8.8
- Jan 1, 2026The Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission – WP User Frontend plugin for WordPress is vulneraCVE-2025-14047 · affects up to 4.2.4 · reported by WordfenceMedium 5.3
- Sep 22, 2025WP User Frontend: Improper Control of Generation of Code ('Code Injection')CVE-2025-58673 · affects up to 4.1.12 · reported by PatchstackMedium 5.4
- Sep 22, 2025WP User Frontend: Missing AuthorizationCVE-2025-58672 · affects up to 4.1.12 · reported by PatchstackMedium 5.4
- Jan 2, 2025WP User Frontend: Missing AuthorizationCVE-2023-45002 · affects up to 3.6.8 · reported by PatchstackMedium 4.3
- Aug 29, 2024WP User Frontend: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-38693 · affects up to 4.0.7 · reported by PatchstackHigh 7.6
- May 17, 2024WP User Frontend: Improper Privilege ManagementCVE-2023-47682 · affects up to 3.6.5 · reported by PatchstackHigh 7.2
- Jun 5, 2023Frontend Post: Does not validate an attribute of one of its shortcodeCVE-2022-4946 · affects up to 2.8.4 · reported by WPScanMedium 5.4
- Nov 21, 2022WP User Frontend: Uses a user supplied argument called urhidden in its registration formCVE-2021-24649 · fixed in 3.5.29 · reported by WPScanCritical 9.8
- Jan 24, 2022WP User Frontend: Does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboardCVE-2021-25076 · fixed in 3.5.26 · reported by WPScan17% oddsHigh 8.8
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Get in touch
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
Not ready to talk yet? Run the free website check and see what Google sees.