---
id: "CVE-2026-115277"
kind: "vulnerability"
aliases: ["CVE-2026-115277"]
title: "User Frontend WordPress plugin: reflected XSS against logged-out visitors"
severity: "medium"
cvss: null
epss: 0.00159
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "user-frontend", "wordpress"]
not_affected_if: ["plugin-not-installed", "plugin-updated"]
published_at: "2026-10-30T06:16:45+00:00"
first_seen_at: "2026-10-30T06:28:39+00:00"
updated_at: "2026-10-30T18:23:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115277", "first_seen_at": "2026-10-30T06:28:39+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115277", "first_seen_at": "2026-10-30T18:23:38+00:00"}]
---

# User Frontend WordPress plugin: reflected XSS against logged-out visitors

The User Frontend WordPress plugin before 4.3.14 reflects some user-supplied values into HTML attributes in a public AJAX response without sanitising them. An attacker can get a crafted link to run script in the browser of logged-out visitors.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the User Frontend plugin in the WordPress admin plugins list or in `wp-content/plugins/`
- Confirm whether the site uses the plugin's public-facing forms or AJAX features

## Fix

- User Frontend WordPress plugin: `4.3.14` or later (per the advisory's 'before 4.3.14' range)

## Timeline

- 2026-10-30T06:28:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115277
- 2026-10-30T18:23:38+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115277

## From the sources

The User Frontend  WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before reflecting them into HTML attributes in a publicly reachable AJAX response, leading to Reflected Cross-Site Scripting. The affected action is gated by an anonymous nonce that only validates for logged-out requests, so the payload executes against logged-out visitors rather than authenticated users.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_