Etoilewebdesign Front End Users — known CVE vulnerabilities

Every CVE whose affected-product data names Etoilewebdesign Front End Users, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (10)

• CVE-2025-2005 — CVSS 9.8 (critical): The Front End Users plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the file uploads…
• CVE-2024-7607 — CVSS 8.8 (high): The Front End Users plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and…
• CVE-2024-13569 — CVSS 7.1 (high): The Front End Users WordPress plugin through 3.2.32 does not sanitise and escape a parameter before outputting it back in the page, leading…
• CVE-2023-33322 — CVSS 7.1 (high): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Etoile Web Design Front End Users…
• CVE-2025-26877 — CVSS 6.5 (medium): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Front End Users…
• CVE-2023-34005 — CVSS 6.5 (medium): Cross-Site Request Forgery (CSRF) vulnerability in Etoile Web Design Front End Users plugin <= 3.2.24 versions.
• CVE-2024-7606 — CVSS 6.4 (medium): The Front End Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'user-search' shortcode in all…
• CVE-2024-13563 — CVSS 6.4 (medium): The Front End Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's forgot-password shortcode in all…
• CVE-2025-47580 — CVSS 5.4 (medium): Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users allows Exploiting Incorrectly Configured Access…
• CVE-2024-12410 — CVSS 4.9 (medium): The Front End Users plugin for WordPress is vulnerable to SQL Injection via the 'UserSearchField' parameter in all versions up to, and…