WP-USER-FRONTEND · CVE-2026-109214 · Package
FIX → 4.3.14 ✓ verified
The User Frontend WordPress plugin up to and including 4.3.13 does not sanitize a taxonomy field parameter, so attackers can store scripts that run in visitors' browsers. An unauthenticated attacker can inject script into pages that execute whenever a user opens the affected page.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted WordPress sites running the User Frontend plugin up to and including 4.3.13 that have a Taxonomy field in text-input mode and guest post submission on at least one frontend form. The vendor changelog says the script ran when an administrator later opened the form in the builder. Sites without that setup, or on 4.3.14 or later, can skip it.
Not affected if default-config, guest-posting-disabled, no-text-taxonomy-field
Who cares self-hosted, user-frontend, wordpress
Upgrade to 4.3.14
Update the User Frontend plugin (wp-user-frontend) to or later (released 28 Oct 2026).
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<taxonomy_field_name> (default: 'category')' parameter in all versions up to, and including, 4.3.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the target installation to have configured a Taxonomy field in text-input mode with guest post submission enabled on at least one frontend form.
This page as .md ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
4.3.14NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.