Stored Cross-Site Scripting in User Frontend Plugin for WordPress
CVE-2026-109214

7.2HIGH

Key Information:

Vendor

WordPress
Status
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction With Frontend Post Submission
Vendor
CVE Published:
7 November 2026

What is CVE-2026-109214?

The User Frontend plugin for WordPress, designed for user management and content restriction, contains a vulnerability that allows unauthenticated attackers to exploit stored cross-site scripting. This occurs through an insufficiently sanitized input parameter, specifically the '<taxonomy_field_name>' (default: 'category')'. Should the site have guest post submissions enabled and a Taxonomy field configured in text-input mode, attackers could inject malicious web scripts, allowing execution whenever a user accesses affected pages.

Affected Version(s)

User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission 0 <= 4.3.13

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wp-user-fronte...
https://plugins.trac.wordpress.org/browser/wp-user-fronte...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chakradhar Chirumamilla
.