User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration vulnerabilities

Product

User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration

by wedevs · last CVE Jul 9, 2026

CVEs

On KEV

5.3

Max CVSS

New 30D

Vulnerabilities3 In the news0 Timeline

Severity mix

Critical 0High 0Medium 3Low 0

Severity

All severities3 Critical0 High0 Medium3 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-12418	5.3	0%	Jul 9	User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Modification via 'wpuf_files_data' Parameter Affected: through 4.3.7
CVE-2026-12406	5.3	1%	Jul 9	User Frontend <= 4.3.7 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attach_id' Parameter Affected: through 4.3.7
CVE-2026-5459	5.3	0%	Jul 8	User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Subscription Overwrite Affected: through 4.3.1