Read the docs

Etoile Web Design

Records32All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high11CVSS 7.0–8.9

Exploited now

Etoile Web Design records in CISA KEV

No Etoile Web Design vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Front End Users 10 records HIGH Ultimate Faq 5 records MEDIUM Ultimate Product Catalog 4 records MEDIUM Order Tracking 3 records LOW Ultimate Reviews 3 records MEDIUM Ultimate Appointment Booking & Scheduling 1 record LOW

Records

10 records in Front End Users · all components

TI-2025-01743 CVE-2025-2005 · GHSA-w6ff-xghx-7936

Front-End-Only-Users <= 3.2.32 - Unauthenticated Arbitrary File Upload

Priority HIGH 68

The Front End Users plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the file uploads field of the registration form in all versions up to, and including, 3.2.32.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.21807 Published 2025-04-02 No fix listed CWE-434
TI-2024-12610 CVE-2024-13569 · GHSA-h3qf-q3hj-98c2

Front End Users <= 3.2.32 - Reflected XSS

Priority MEDIUM 64

The Front End Users WordPress plugin through 3.2.32 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege u…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00549 Published 2025-04-22 No fix listed CWE-79
TI-2025-30077 CVE-2025-47580 · GHSA-p274-32q4-g22c

WordPress Front End Users plugin <= 3.2.35 - Broken Access Control vulnerability

Priority MEDIUM 42

Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Front End Users: from n/a through <= 3.2.3…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00297 Published 2025-05-15 No fix listed CWE-862
TI-2024-07051 CVE-2024-7607 · GHSA-7xcm-586q-jcgq

Front End Users <= 3.2.28 - Authenticated (Contributor+) Time-Based SQL Injection

Priority MEDIUM 41

The Front End Users plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.2.28 due to insufficient escaping on the user supplied parameter and la…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00543 Published 2024-08-29 No fix listed CWE-89
TI-2023-16481 CVE-2023-33322 · GHSA-7p33-pjfm-c7hj

WordPress Front End Users plugin < 3.2.25 - Cross Site Scripting (XSS) vulnerability

Priority LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Etoile Web Design Front End Users allows Reflected XSS.This issue affects Front End Users: from n/a before 3.2.25.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00379 Published 2024-03-26 Fixed in 3.2.25 CWE-79
TI-2024-12604 CVE-2024-13563 · GHSA-m4pp-r8qf-wcpc

Front End Users <= 3.2.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via forgot-password Shortcode

Priority LOW 30

The Front End Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's forgot-password shortcode in all versions up to, and including, 3.2.30 due to insufficient input sanitization and out…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00308 Published 2025-02-15 No fix listed CWE-79
TI-2025-19748 CVE-2025-26877 · GHSA-qf47-cq5r-x3c3

WordPress Front End Users Plugin <= 3.2.30 - Cross Site Scripting (XSS) vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Front End Users front-end-only-users allows Stored XSS.This issue affects Front End Users: from n/a through…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00257 Published 2025-02-25 No fix listed CWE-79
TI-2024-07050 CVE-2024-7606 · GHSA-87x7-pxqw-4gff

Front End Users <= 3.2.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Priority LOW 28

The Front End Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'user-search' shortcode in all versions up to, and including, 3.2.28 due to insufficient input sanitization and outpu…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00329 Published 2024-08-29 No fix listed CWE-79
TI-2024-11514 CVE-2024-12410 · GHSA-qm6q-x38h-hpp4

Front End Users <= 3.2.32 - Authenticated (Admin+) SQL injection

Priority LOW 23

The Front End Users plugin for WordPress is vulnerable to SQL Injection via the 'UserSearchField' parameter in all versions up to, and including, 3.2.32 due to insufficient escaping on the user supplied parameter and lac…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00459 Published 2025-04-02 No fix listed CWE-89
Open these records in search →