Threats tagged 'ghsa-g38f-36qr-wwhh'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
Medium	6.1	CVE-2026-103962The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Medium6.12026-10-31GCVE DatabaseCVE-2026-103962 The User Frontend WordPress plugin up to version 4.3.13 is vulnerable to reflected cross-site scripting (XSS) via the 'field_attr[required]' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. The nonce check intended to protect the AJAX action is ineffective because the nonce value is publicly accessible to anonymous visitors, enabling attackers to harvest it and bypass protections. Report on CVE-2026-103962 Vulnerability CWE-79 #ghsa-g38f-36qr-wwhh	GCVE Database	2026-10-31

Page 1 of 1