The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for… (CVE-2026-96574)

CVE-2026-96574 describes a stored cross-site scripting vulnerability in The User Frontend WordPress plugin (versions up to and including 4.3.12). The issue is due to improper sanitization and escaping of the 'wpuf_payment_method' parameter, allowing authenticated attackers with subscriber or higher privileges to inject arbitrary JavaScript. The bypass involves appending a valid payment gateway keyword (e.g., 'bank') to the malicious payload, causing sanitize_text_field() to return only the keyword for routing while the full malicious input is stored and later rendered unescaped, leading to script execution in users' browsers.

An attacker with subscriber-level access or higher can inject persistent malicious scripts into pages viewed by other users, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not allow privilege escalation or denial of service but compromises confidentiality and integrity of user sessions and data via cross-site scripting.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict user roles to trusted users only and consider disabling or limiting the use of the 'wpuf_payment_method' parameter. Monitor official vendor channels for updates and apply any official fixes promptly once released.