Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: User Frontend 4.3.10 Clear all filters
TI-2026-12291 CVE-2026-14567 · GHSA-vwp5-qxw4-4vgw

WP User Frontend < 4.3.10 - Unauthenticated User Email and Phone Disclosure via User Directory

Priority LOW 30

The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user,…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00345 Published 2026-08-28 Fixed in 4.3.10 CWE-200
TI-2026-12282 CVE-2026-14558 · GHSA-j5mw-m2j3-5747

WP User Frontend < 4.3.10 - Editor+ PHP Object Injection via AI Form Builder

Priority LOW 35

The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access an…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00777 Published 2026-08-28 Fixed in 4.3.10 CWE-502