Vulnerability · Published Oct 30, 2026 · Assigned by WPScan

CVE-2026-115277WP User Frontend < 4.3.14 - Reflected XSS via 'field_attr' Parameter

Medium 4.7

In plain English

A medium-severity cross-site scripting in User Frontend from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)0.2%top 93.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The User Frontend WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before reflecting them into HTML attributes in a publicly reachable AJAX response, leading to Reflected Cross-Site Scripting. The affected action is gated by an anonymous nonce that only validates for logged-out requests, so the payload executes against logged-out visitors rather than authenticated users.

Affected products (as reported)

Vendor	Product	Versions
Unknown	User Frontend	0 – before 4.3.14

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

References

https://wpscan.com/vulnerability/b3f0ca09-1c63-4a34-90bf-7b220fcec556/ exploit, vdb-entry, technical-description