{"id":"CVE-2026-115277","title":"WP User Frontend < 4.3.14 - Reflected XSS via 'field_attr' Parameter","summary":"The User Frontend  WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before reflecting them into HTML attributes in a publicly reachable AJAX response, leading to Reflected Cross-Site Scripting. The af…","severity":"medium","cvss":4.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","cvssSource":"adp","cwe":["CWE-79"],"product":"User Frontend","affected":["user_frontend < 4.3.14"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-30T13:18:13.926399Z"},"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T13:26:47.565Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115277","references":[{"url":"https://wpscan.com/vulnerability/b3f0ca09-1c63-4a34-90bf-7b220fcec556/"}],"tags":["cve.org"],"epss":0.00175,"epssPercentile":0.06986,"ingestedAt":"2026-11-05T16:07:30.265Z","slug":"CVE-2026-115277","body":"## Overview\n\nThe User Frontend  WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before reflecting them into HTML attributes in a publicly reachable AJAX response, leading to Reflected Cross-Site Scripting. The affected action is gated by an anonymous nonce that only validates for logged-out requests, so the payload executes against logged-out visitors rather than authenticated users.\n\n## Affected\n\n- `user_frontend < 4.3.14`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":25.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}