Frontend User Notes <= 2.1.1 - Cross-Site Request Forgery to Note Content Modification via 'confirmEdit' Action
medium
The Frontend User Notes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the funp_ajax_modify_notes function. This makes it possible for unauthenticated attackers to trick a logged-in user into visiting...
- CVSS:
- 4.3
- Affected:
- up to 2.1.1
- Fixed in:
- 2.2.0
- Disclosed:
- Jun 5, 2026
CVE-2026-7047 on NVD →
Frontend User Notes [frontend-user-notes] < 2.1.1
unknown
[en] The Frontend User Notes plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.0 via the 'funp_ajax_modify_notes' AJAX endpoint due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level acc...
- Affected:
- up to 2.1.1
- Fixed in:
- 2.1.1
- Disclosed:
- Feb 18, 2026
CVE-2025-12071 on NVD →
Frontend User Notes <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Note Modification
medium
The Frontend User Notes plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.0 via the 'funp_ajax_modify_notes' AJAX endpoint due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access a...
- CVSS:
- 4.3
- Affected:
- up to 2.1.0
- Fixed in:
- 2.1.1
- Disclosed:
- Feb 17, 2026
CVE-2025-12071 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database