{"id":"CVE-2026-115277","kind":"vulnerability","aliases":["CVE-2026-115277"],"related":[],"title":"User Frontend WordPress plugin: reflected XSS against logged-out visitors","description":"The User Frontend  WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before reflecting them into HTML attributes in a publicly reachable AJAX response, leading to Reflected Cross-Site Scripting. The affected action is gated by an anonymous nonce that only validates for logged-out requests, so the payload executes against logged-out visitors rather than authenticated users.","summary":"The User Frontend WordPress plugin before 4.3.14 reflects some user-supplied values into HTML attributes in a public AJAX response without sanitising them. An attacker can get a crafted link to run script in the browser of logged-out visitors.","severity":"medium","cvss":null,"epss":0.00159,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","user-frontend","wordpress"],"not_affected_if":["plugin-not-installed","plugin-updated"],"how_to_check":"- Check the installed version of the User Frontend plugin in the WordPress admin plugins list or in `wp-content/plugins/`\n- Confirm whether the site uses the plugin's public-facing forms or AJAX features","fix":"- User Frontend WordPress plugin: `4.3.14` or later (per the advisory's 'before 4.3.14' range)","status":"open","published_at":"2026-10-30T06:16:45+00:00","first_seen_at":"2026-10-30T06:28:39+00:00","triaged_at":"2026-10-30T06:30:05+00:00","updated_at":"2026-10-30T18:23:38+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T06:30:05Z","model":"claude-haiku-5-5","output":{"fix":"- User Frontend WordPress plugin: `4.3.14` or later (per the advisory's 'before 4.3.14' range)","reach":"internet","title":"User Frontend WordPress plugin: reflected XSS against logged-out visitors","impact":"medium","summary":"The User Frontend WordPress plugin before 4.3.14 reflects some user-supplied values into HTML attributes in a public AJAX response without sanitising them. An attacker can get a crafted link to run script in the browser of logged-out visitors.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","user-frontend","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"script runs in logged-out visitors' browsers via crafted link","analyst_note":"","how_to_check":"- Check the installed version of the User Frontend plugin in the WordPress admin plugins list or in `wp-content/plugins/`\n- Confirm whether the site uses the plugin's public-facing forms or AJAX features","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-updated","plugin-not-installed"],"who_is_affected":"Sites running the User Frontend plugin before 4.3.14 are exposed through its publicly reachable AJAX response, which does not escape user-supplied values. The flaw is reachable by logged-out visitors, so any public site using the plugin's front-end features should be reviewed. Sites without the plugin, or running 4.3.14 or later, are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000701,"input_tokens":4153,"output_tokens":571,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115277':14A,17A '-2026':13A,16A '4.3.14':32B,74C 'action':106C 'affect':105C 'ajax':45B,95C 'anonym':111C 'attack':51B 'attribut':41B,90C 'authent':132C 'browser':62B 'craft':55B 'cross':101C 'cross-sit':100C 'cve':12A,15A 'escap':79C 'execut':124C 'frontend':2A,24B,28B,70C 'gate':108C 'get':53B 'host':21B 'html':40B,89C 'lead':97C 'link':56B 'log':9A,65B,118C,127C 'logged-out':8A,64B,117C,126C 'nonc':112C 'packag':18B 'payload':123C 'plugin':4A,30B,72C 'public':44B,93C 'rather':130C 'reachabl':94C 'reflect':5A,33B,86C,99C 'request':120C 'respons':46B,96C 'run':58B 'sanitis':48B,77C 'script':59B,103C 'self':20B 'self-host':19B 'site':102C 'suppli':37B,83C 'user':1A,23B,27B,36B,69C,82C,133C 'user-frontend':22B 'user-suppli':35B,81C 'valid':115C 'valu':38B,84C 'visitor':11A,67B,129C 'without':47B 'wordpress':3A,25B,29B,71C 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Sites running the User Frontend plugin before 4.3.14 are exposed through its publicly reachable AJAX response, which does not escape user-supplied values. The flaw is reachable by logged-out visitors, so any public site using the plugin's front-end features should be reviewed. Sites without the plugin, or running 4.3.14 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T06:16:45+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115277","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115277","severity":null,"published_at":"2026-10-30T06:16:45+00:00","modified_at":"2026-10-30T06:16:45+00:00","first_seen_at":"2026-10-30T06:28:39+00:00","fetched_at":"2026-10-30T06:28:39+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115277","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115277","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-30T18:23:38+00:00","fetched_at":"2026-10-30T18:23:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}