The WordPress plugin User Frontend is vulnerable to a reflected XSS flaw that arises from the lack of input sanitization and output escaping on the 'field_attr[required]' parameter. Attackers can inject arbitrary scripts into pages that are rendered when a victim interacts with content crafted by the attacker, such as clicking a link. This vulnerability permits unauthenticated attackers to execute code in the context of the victim’s browser, potentially enabling session hijacking, data theft or further phishing attacks.

The flaw affects all published releases of the User Frontend plugin up to and including version 4.3.13. The vulnerability is present in the base plugin and all its subsystem components, including membership, registration, profile, directory and content restriction modules supplied by Wedevs for WordPress.

The vulnerability scores a CVSS base of 6.1, reflecting moderate impact and ease of exploitation. EPSS data is not available, and the flaw is not listed in CISA KEV. The attack requires only that an unauthenticated user be able to reach a page containing a User Frontend shortcode containing the vulnerable parameter; the nonce mechanism is ineffective because it is publicly accessible. Given that the vulnerability can be triggered from any external link, the risk to sites hosting the vulnerable plugin is high; a single malicious URL could compromise any unsuspecting user who visits it.