CVE-2026-109214

Description

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<taxonomy_field_name> (default: 'category')' parameter in all versions up to, and including, 4.3.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the target installation to have configured a Taxonomy field in text-input mode with guest post submission enabled on at least one frontend form.

Overview

State: PUBLISHED
Assigner (CNA): Wordfence
CVSS severity: HIGH
CVSS score: 7.2 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Effective score: 7.2 / 10 HIGH source: CNA overview
CWE(s): CWE-79
Reserved: 2026-10-12
Published: 2026-11-07 11:26 UTC
Last updated: 2026-11-07 18:05 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109214.json
Linked Threat: CVE-2026-109214 — User Frontend <= 4.3.13 - Unauthenticated Stored Cross-Site Scripting via Taxonomy Field Text-Input

Affected products (1)

Vendor	Product	Versions	Platforms
wedevs	User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission	`0` (affected)	—

Vendor references (8)

References embedded in the original CVE record by the assigning CNA.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

Indicators (1)

IOCs linked to the auto-promoted Threat row.

Type	Value	VirusTotal	Attached
cve	`CVE-2026-109214`	no local data	2026-11-07 00:24 UTC

Remediations (9)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Microsoft Patch Tuesday, October 2026 Security Update Review

web:blog.qualys.com

Microsoft has released its October 2026 Patch Tuesday security updates, addressing vulnerabilities across its products and services.

2026-11-07 00:24 UTC
October 2026 Critical Patch Update Released | security

web:blogs.oracle.com

For more information about the Critical Patch Update program, see the security vulnerability remediation practices page located on the Oracle Trust Center.

2026-11-07 00:24 UTC
Security Advisories and Bulletins | Microsoft Learn

web:learn.microsoft.com

In this library you will find the following security documents that have been released by the Microsoft Security Response Center (MSRC). The MSRC investigates all reports of security vulnerabilities affecting Microsoft products and services, and releases these documents as part of the ongoing effort ...

2026-11-07 00:24 UTC
October 2026 CVE Roundup - mylinux.work

web:mylinux.work

Network Edge and Remote Access Ivanti Connect Secure — CVE - 2026 -104935, CVE - 2026 -111357, and CVE - 2026 -118527 These three form one exploit chain. CVE - 2026 -104935 (added October 13) lets an unauthenticated attacker bypass authentication and run commands. CVE - 2026 -118527 lets the attacker write content to a predictable location on disk, and CVE - 2026 -111357 turns local access into root. Ivanti ...

2026-11-07 00:24 UTC
Microsoft Patch Tracker (October 2026): Exploit-Ranked | Senserva

web:senserva.com

Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.

2026-11-07 00:24 UTC
Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days

web:www.bleepingcomputer.com

Today is Microsoft's October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities.

2026-11-07 00:24 UTC
Oracle Critical Patch Update Advisory - October 2026

web:www.oracle.com

This Critical Patch Update contains 1295 new security patches across the product families listed below. Please note that a My Oracle Support (MOS) note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at October 2026 Critical Patch Update: Executive Summary and Analysis.

2026-11-07 00:24 UTC
ZDI-26-894 - TrendAI™ Zero Day Initiative™ (ZDI)

web:www.zerodayinitiative.com

TrendAI™ ZDI connects the experts who discover, remediate, and defend. Add your voice to the work that pushes attackers back.

2026-11-07 00:24 UTC
Wordfence remediation: User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission

Wordfence

Update to version 4.3.14, or a newer patched version

2026-11-07 00:24 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-109214.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109214",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T17:59:19.711610Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:05:59.667Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission",
          "vendor": "wedevs",
          "versions": [
            {
              "lessThanOrEqual": "4.3.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Chakradhar Chirumamilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<taxonomy_field_name> (default: 'category')' parameter in all versions up to, and including, 4.3.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the target installation to have configured a Taxonomy field in text-input mode with guest post submission enabled on at least one frontend form."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:34.590Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ca1837a4-ea04-4a82-aadb-43e9cff28833?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.13/admin/form-builder/views/post-form-settings.php#L498"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.13/admin/html/form-settings-post.php#L118"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.13/includes/Traits/FieldableTrait.php#L745"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.13/includes/Ajax/Frontend_Form_Ajax.php#L36"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.13/includes/Ajax.php#L26"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.13/admin/form-builder/assets/js/form-builder.js#L666"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3770255%40wp-user-frontend%2Ftags%2F4.3.14&old=3722911%40wp-user-frontend%2Ftags%2F4.3.13"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-12T13:53:34.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T23:13:49.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "User Frontend <= 4.3.13 - Unauthenticated Stored Cross-Site Scripting via Taxonomy Field Text-Input"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-109214",
    "datePublished": "2026-11-07T11:26:34.590Z",
    "dateReserved": "2026-10-12T13:38:09.368Z",
    "dateUpdated": "2026-11-07T18:05:59.667Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}