Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: User Frontend 4.3.11 Clear all filters
TI-2026-14402 CVE-2026-17563 · GHSA-rgv4-fwhv-pq9x

WP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated Form

Priority LOW 30

The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create an…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00304 Published 2026-09-02 Fixed in 4.3.11 CWE-862
TI-2026-15615 CVE-2026-19116 · GHSA-f6hp-2qj5-48vv

WP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit Form

Priority MEDIUM 41

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subsc…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00746 Published 2026-09-02 Fixed in 4.3.11 CWE-502