Wedevs Wp User Frontend Pro vulnerabilities

3 CVEs affecting Wedevs Wp User Frontend Pro, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-32572, published 2026-10-06.

More from Wedevs.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-3054, published 2025-06-05. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload_files() function in all versions up to, and including, 4.1.3.…
• CVE-2025-3055, published 2025-06-05. High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days. The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_avatar_ajax() function in all versions up to, and…
• CVE-2026-32572, published 2026-10-06. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions.