Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

10 records

Vendor: Etoile Web Design Component: Front End Users Clear all filters
TI-2025-30077 CVE-2025-47580 · GHSA-p274-32q4-g22c

WordPress Front End Users plugin <= 3.2.35 - Broken Access Control vulnerability

Priority MEDIUM 42

Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Front End Users: from n/a through <= 3.2.3…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00297 Published 2025-05-15 No fix listed CWE-862
TI-2024-12610 CVE-2024-13569 · GHSA-h3qf-q3hj-98c2

Front End Users <= 3.2.32 - Reflected XSS

Priority MEDIUM 64

The Front End Users WordPress plugin through 3.2.32 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege u…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00549 Published 2025-04-22 No fix listed CWE-79
TI-2024-11514 CVE-2024-12410 · GHSA-qm6q-x38h-hpp4

Front End Users <= 3.2.32 - Authenticated (Admin+) SQL injection

Priority LOW 23

The Front End Users plugin for WordPress is vulnerable to SQL Injection via the 'UserSearchField' parameter in all versions up to, and including, 3.2.32 due to insufficient escaping on the user supplied parameter and lac…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00459 Published 2025-04-02 No fix listed CWE-89
TI-2025-01743 CVE-2025-2005 · GHSA-w6ff-xghx-7936

Front-End-Only-Users <= 3.2.32 - Unauthenticated Arbitrary File Upload

Priority HIGH 68

The Front End Users plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the file uploads field of the registration form in all versions up to, and including, 3.2.32.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.21807 Published 2025-04-02 No fix listed CWE-434
TI-2025-19748 CVE-2025-26877 · GHSA-qf47-cq5r-x3c3

WordPress Front End Users Plugin <= 3.2.30 - Cross Site Scripting (XSS) vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Front End Users front-end-only-users allows Stored XSS.This issue affects Front End Users: from n/a through…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00257 Published 2025-02-25 No fix listed CWE-79
TI-2024-12604 CVE-2024-13563 · GHSA-m4pp-r8qf-wcpc

Front End Users <= 3.2.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via forgot-password Shortcode

Priority LOW 30

The Front End Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's forgot-password shortcode in all versions up to, and including, 3.2.30 due to insufficient input sanitization and out…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00308 Published 2025-02-15 No fix listed CWE-79
TI-2024-07051 CVE-2024-7607 · GHSA-7xcm-586q-jcgq

Front End Users <= 3.2.28 - Authenticated (Contributor+) Time-Based SQL Injection

Priority MEDIUM 41

The Front End Users plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.2.28 due to insufficient escaping on the user supplied parameter and la…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00543 Published 2024-08-29 No fix listed CWE-89
TI-2024-07050 CVE-2024-7606 · GHSA-87x7-pxqw-4gff

Front End Users <= 3.2.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Priority LOW 28

The Front End Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'user-search' shortcode in all versions up to, and including, 3.2.28 due to insufficient input sanitization and outpu…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00329 Published 2024-08-29 No fix listed CWE-79
TI-2023-16481 CVE-2023-33322 · GHSA-7p33-pjfm-c7hj

WordPress Front End Users plugin < 3.2.25 - Cross Site Scripting (XSS) vulnerability

Priority LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Etoile Web Design Front End Users allows Reflected XSS.This issue affects Front End Users: from n/a before 3.2.25.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00379 Published 2024-03-26 Fixed in 3.2.25 CWE-79