CVE-2026-96574: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in wedevs User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission

CVE-2026-96574 is a stored cross-site scripting vulnerability in the User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission WordPress plugin. The vulnerability affects all versions up to and including 4.3.12. It occurs due to insufficient input sanitization and output escaping of the 'wpuf_payment_method' parameter. Authenticated attackers with subscriber-level privileges or higher can inject arbitrary web scripts that execute when users access the injected pages. The attack bypasses the sanitize_text_field() function by appending a valid gateway keyword such as 'bank' to the malicious payload, causing the sanitization to only retain the keyword for routing while storing the full malicious input unescaped.

An attacker with subscriber-level or higher access can inject persistent malicious scripts into pages viewed by other users, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability has a CVSS score of 6.4 (medium severity), indicating a moderate impact on confidentiality and integrity without affecting availability. There are no known exploits in the wild at this time.

No official patch or fix is currently documented for this vulnerability. Users should monitor the vendor's advisory for updates and apply any forthcoming patches promptly. Until a fix is available, restricting subscriber-level user capabilities or disabling the affected plugin may reduce risk. Avoid using or exposing the 'wpuf_payment_method' parameter to untrusted input. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.