Live › vulnerability › CVE-2026-115277
The User Frontend WordPress plugin before 4.3.14 reflects some user-supplied values into HTML attributes in a public AJAX response without sanitising them. An attacker can get a crafted link to run script in the browser of logged-out visitors.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 06:28 UTC. All times on this page are UTC.
Sites running the User Frontend plugin before 4.3.14 are exposed through its publicly reachable AJAX response, which does not escape user-supplied values. The flaw is reachable by logged-out visitors, so any public site using the plugin's front-end features should be reviewed. Sites without the plugin, or running 4.3.14 or later, are not affected.
No product ranges from the sources yet.
wp-content/plugins/4.3.14 or later (per the advisory's 'before 4.3.14' range)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The User Frontend WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before reflecting them into HTML attributes in a publicly reachable AJAX response, leading to Reflected Cross-Site Scripting. The affected action is gated by an anonymous nonce that only validates for logged-out requests, so the payload executes against logged-out visitors rather than authenticated users.
This page as .md · .json · in your agent: get_signal("CVE-2026-115277")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.