CVE-2026-32572 Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions

Description

Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions.

Affected products and versions

Product	Affected versions	Fixed in
WP User Frontend Pro 4.2	earliest → 4.2.13	No fix stated

Other CVEs of WP User Frontend Pro

The 3 CVEs of WP User Frontend Pro →

CVE-2025-3054 The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type… 8.8 High CVE-2025-3055 The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path… 8.1 High