The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting

• https://nvd.nist.gov/vuln/detail/CVE-2021-25076

• https://www.exploit-db.com/exploits/50772

• Vendor Homepage: https://wedevs.com/

• Software Link: https://downloads.wordpress.org/plugin/wp-user-frontend.3.5.25.zip

• Version: Up to 3.5.25

• Tested on Ubuntu 20.04

• 🕊️ Twitter: @0xAbbarhSF