CVE-2026-96574

Name of the Vulnerable Software and Affected Versions User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission versions prior to 4.3.13

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs via the wpuf payment method parameter, enabling the injection of arbitrary web scripts into pages that execute when accessed by other users. The issue is triggered by appending a valid gateway keyword, such as 'bank', to the HTML payload, which bypasses the sanitize text field() function by returning only the keyword for routing while storing the full malicious raw value for later unescaped rendering.

Recommendations Update to a version newer than 4.3.12. Avoid using the wpuf payment method parameter until the update is applied.