CVE-2026-103962

Name of the Vulnerable Software and Affected Versions User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission versions prior to 4.3.14

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs via the field attr[required] parameter, enabling the injection of arbitrary web scripts that execute when a user is tricked into clicking a malicious link. The nonce check on the wpuf get child cat() AJAX action is ineffective because the wpuf nonce value is publicly localized to anonymous visitors on pages containing a WPUF shortcode, allowing it to be harvested by attackers.

Recommendations Update to version 4.3.14 or later.