Unknown User Frontend vulnerabilities

6 CVEs affecting Unknown User Frontend, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-75824, published 2026-09-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-14558, published 2026-08-28. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with…
CVE-2026-19116, published 2026-09-02. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing…
CVE-2026-14567, published 2026-08-28. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of…
CVE-2026-75823, published 2026-09-30. High severity, CVSS 7.4. EPSS: 0.3% chance of exploitation in the next 30 days. The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role,…
CVE-2026-75824, published 2026-09-30. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The User Frontend WordPress plugin before 4.3.12 does not check whether the site allows user registration before creating an account, allowing unauthenticated users to create accounts on sites where…
CVE-2026-17563, published 2026-09-02. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing…