The WordPress plugin User Frontend is vulnerable to stored Cross‑Site Scripting in all releases up to and including version 4.3.13. The flaw arises because the plugin accepts and stores the value of the taxonomy_field_name parameter without adequate sanitization or escaping. An attacker who can submit a form that includes a taxonomy field set to text‑input mode and guest post submission enabled can embed arbitrary JavaScript into the stored value. When a site visitor later loads the affected page, the injected script is executed within the visitor’s browser, allowing the attacker to run code in the context of the site. The impact is the ability to execute any script chosen by the attacker on the browsers of users who view the content, potentially compromising confidentiality, integrity, or availability of site data.

Vendor: Wedevs. Product: User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin. Versions: all releases 4.3.13 and earlier. The vulnerability exists in the plugin code that handles taxonomy field input, including form builder, post form settings, and front‑end AJAX processing.

The CVSS score of 7.2 indicates a high severity vulnerability. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. Exploitation requires no authentication – an attacker needs only a web browser capable of submitting a form with the vulnerable taxonomy field and guest post submission enabled. Once the malicious script is stored, any user who opens the affected page will trigger the code. Given the widespread deployment of the plugin and the low barrier to entry, the likelihood of exploitation is significant in environments where the vulnerable configuration remains active and the plugin has not been updated.