Description

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpuf_payment_method' parameter in all versions up to, and including, 4.3.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The bypass technique involves appending a valid gateway keyword such as 'bank' to the HTML payload, causing sanitize_text_field() to yield only the keyword for routing purposes while the full malicious raw value is stored and later rendered unescaped.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-10-10T07:16:42.627Z",
  "pubdate": "2026-10-10T07:16:42.627Z",
  "executiveSummary": "The User Frontend plugin for WordPress (versions 4.3.12 and earlier) is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability via the 'wpuf_payment_method' parameter.\nThis vulnerability arises from inadequate input sanitization and a failure to perform output escaping, allowing authenticated users with at least subscriber-level permissions to inject arbitrary JavaScript.\nThe impact is significant, as the injected scripts execute in the context of other users' sessions, potentially leading to unauthorized actions, session hijacking, or sensitive data exposure.\nExploitation requires an attacker to possess valid subscriber credentials and leverage a specific sanitization bypass technique involving keyword injection.\nThe vulnerability highlights a critical breakdown in the application's data handling lifecycle, where raw user input is stored and subsequently rendered without appropriate security controls.",
  "technicalDetails": "The root cause of this vulnerability is the implementation of 'sanitize_text_field()' on the 'wpuf_payment_method' parameter, which is insufficient to handle maliciously crafted inputs designed to bypass logic-based filters.\nThe application relies on this function to validate payment gateway keywords; however, the bypass technique exploits the fact that if a valid keyword (e.g., 'bank') is appended to a malicious HTML/JavaScript payload, the sanitization function may return the keyword for the internal routing logic while the database retains the full, uncleaned string.\nThe attack flow commences when an authenticated attacker submits a crafted POST request targeting the 'wpuf_payment_method' parameter. By including a payload such as 'bank<script>alert(1)</script>', the application's sanitization routine identifies the string 'bank' as a valid gateway identifier.\nThe server processes the request, routing it correctly due to the inclusion of the valid keyword, but fails to sanitize or neutralize the appended malicious script before committing the value to the database.\nOnce stored, the malicious payload is rendered in the backend or frontend administrative pages where the payment method is displayed. Because the plugin fails to perform context-aware output escaping when rendering this field, the browser interprets the injected script as legitimate markup.\nThe vulnerability is present in all versions up to, and including, 4.3.12. It requires an attacker to be authenticated with at least subscriber privileges, making it a critical concern for WordPress sites utilizing front-end registration or content submission features.\nPost-exploitation, an attacker can execute arbitrary JavaScript within the session of an administrator or any other user who views the affected page. This can be weaponized to perform administrative actions, capture session cookies, or redirect users to malicious domains, effectively escalating the attacker's privileges and compromising the integrity of the WordPress instance."
}