Wpfront User Role Editor Vulnerabilities

The WPFront User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts...

CVSS:

6.4

Affected:

up to 4.2.3

Fixed in:

4.2.4

Disclosed:

Sep 26, 2025

CVE-2025-60102 on NVD →

The WPFront User Role Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.1. This is due to missing or incorrect nonce validation on the whitelist_options() function. This makes it possible for unauthenticated attackers to update the default role option that...

CVSS:

8.8

Affected:

up to 4.2.1

Fixed in:

4.2.2

Disclosed:

Apr 7, 2025

CVE-2025-3064 on NVD →

[en] The WPFront User Role Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.1.11184 via the wpfront_user_role_editor_assign_roles_user_autocomplete AJAX action. This makes it possible for authenticated attackers, with subscriber-level access and above...

Affected:

up to 4.1.0

Fixed in:

4.1.0

Disclosed:

Apr 2, 2024

CVE-2024-2931 on NVD →

The WPFront User Role Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.1.11184 via the wpfront_user_role_editor_assign_roles_user_autocomplete AJAX action. This makes it possible for authenticated attackers, with subscriber-level access and above, to...

CVSS:

4.3

Affected:

up to 3.2.1.11184

Fixed in:

4.1.0

Disclosed:

Apr 1, 2024

CVE-2024-2931 on NVD →

[en] The WPFront User Role Editor WordPress plugin before 3.2.1.11184 does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting

Affected:

up to 3.2.1.11184

Fixed in:

3.2.1.11184

Disclosed:

Dec 27, 2021

CVE-2021-24984 on NVD →

The WPFront User Role Editor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘changes-saved’ parameter in versions before 3.2.1.11184 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages tha...

CVSS:

6.1

Affected:

up to 3.2.1.11184

Fixed in:

3.2.1.11184

Disclosed:

Nov 23, 2021

The WPFront User Role Editor WordPress plugin before 3.2.1 does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting

CVSS:

6.1

Affected:

up to 3.2.0

Fixed in:

3.2.1

Disclosed:

Nov 23, 2021

CVE-2021-24984 on NVD →

The WPFront User Role Editor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘changes-saved’ parameter in versions before 3.2.1.11184 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages tha...

Affected:

up to 3.2.1.11184

Fixed in:

3.2.1.11184

Disclosed:

Nov 23, 2021

Affected:

up to 4.2.2

Fixed in:

4.2.2

CVE-2025-3064 on NVD →

Affected:

up to 4.2.4

Fixed in:

4.2.4

CVE-2025-60102 on NVD →