User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration

Vulnerabilities 23Slug wp-user-frontendLatest version 4.3.2WordPress.org →

Minimum safe version

4.3.2

Update to 4.3.2 or later to address 23 fixable vulnerabilities

Latest available4.3.2 ✓
Medium 5.4
2025-09-22< 4.1.13

WP User Frontend <= 4.1.12 - Authenticated (Subscriber+) Arbitrary Shortcode Execution

WordfenceEUVDCVE
N/A
2026-02-26< 4.2.9

User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Authenticated (Author+) Arbitrary File Upload

WordfenceCVE
N/A
2026-03-14< 4.2.9

User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Post Modification via 'post_id' Parameter

WordfenceCVE
Medium 5.4
2025-09-22< 4.1.13

WordPress WP User Frontend Plugin <= 4.1.12 is vulnerable to Broken Access Control

PatchstackWordfenceEUVDCVE
N/A
2024-07-03< 4.0.8

WordPress WP User Frontend Plugin <= 4.0.7 is vulnerable to Backdoor

Patchstack
N/A
2024-06-25< 4.0.8

Various Plugins <= Various Version - Use of Polyfill.io

Wordfence
N/A
< 2.3.11

WP User Frontend &lt;= 2.3.10 - Unrestricted File Upload

WPScan
N/A
< 3.5.25

WP User Frontend &lt; 3.5.25 - Admin+ SQL Injection

WPScan
N/A
2023-03-21< 3.6.1

WordPress WP User Frontend Plugin <= 3.6.0 is vulnerable to Cross Site Request Forgery (CSRF)

PatchstackCVE
N/A
2016-02-08< 2.3.11

WP User Frontend < 2.3.11 - Arbitrary File Upload

Wordfence
N/A
2021-11-18< 3.5.25

WP User Frontend – Membership, Profile, Registration & Post Submission Plugin for WordPress < 3.5.25 - Authenticated (Admin+) SQL Injection

Wordfence
N/A
2016-02-08< 2.3.11

WordPress WP User Frontend Plugin 2.3.10 - Unrestricted File Upload

Patchstack
N/A
2021-11-18< 3.5.25

WordPress WP User Frontend plugin <= 3.5.23 - SQL Injection (SQLi) vulnerability

Patchstack