Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 8

Export CSV
CVE-2026-93896

WPFront Notification Bar <= 3.5.1 - Reflected Cross-Site Scripting via REQUEST_URI

The WPFront Notification Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.5.1. This is due to the debug-log output path (write_debug_logs) reflecting the raw value of $_SERVER['REQUEST_URI'] through vprintf() directly inside a <script> block emitted on wp_footer, without any sanitization or escaping (see the 'Current URL is "%s"' log entry produced by the URL-text display filter in the filter() method). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpfront
Products
Wpfront Notification Bar Notification Bar
CVE-2025-60102

WordPress WPFront User Role Editor Plugin <= 4.2.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syam Mohan WPFront User Role Editor wpfront-user-role-editor allows Stored XSS.This issue affects WPFront User Role Editor: from n/a through <= 4.2.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpfront
Products
Wordpress Wpfront User Role Editor
CVE-2024-2931

WPFront User Role Editor <= 3.2.1.11184 - Limited Information Exposure

The WPFront User Role Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.1.11184 via the wpfront_user_role_editor_assign_roles_user_autocomplete AJAX action. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract retrieve a list of all user email addresses who are registered on the site.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wpfront
Products
Wpfront User Role Editor
CVE-2024-0625

WPFront Notification Bar <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via wpfront-notification-bar-options[custom_class]

The WPFront Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpfront-notification-bar-options[custom_class]’ parameter in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wpfront
Products
Wpfront Notification Bar
CVE-2021-24984

WPFront User Role Editor < 3.2.1.11184 - Reflected Cross-Site Scripting

The WPFront User Role Editor WordPress plugin before 3.2.1.11184 does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Wpfront
Products
Wpfront User Role Editor
CVE-2021-24601

WPFront Notification Bar < 2.1.0.08087 - Authenticated Stored XSS

The WPFront Notification Bar WordPress plugin before 2.1.0.08087 does not properly sanitise and escape its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wpfront
Products
Wpfront Notification Bar
CVE-2021-24564

WPFront Scroll Top < 2.0.6.07225 - Authenticated Stored XSS

The WPFront Scroll Top WordPress plugin before 2.0.6.07225 does not sanitise or escape its Image ALT setting before outputting it attributes, leading to an Authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wpfront
Products
Scroll Top
CVE-2021-24518

WPFront Notification Bar < 2.0.0.07176 - Authenticated Stored XSS

The WPFront Notification Bar WordPress plugin before 2.0.0.07176 does not sanitise or escape its Custom CSS setting, allowing high privilege users such as admin to set XSS payload in it even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wpfront
Products
Notification Bar