CVE-2021-25076

The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting

• CWE-89

• http://packetstormsecurity.com/files/166071/WordPress-WP-User-Frontend-3.5.25-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://plugins.trac.wordpress.org/changeset/2648715Patch, Third Party Advisory
• https://wpscan.com/vulnerability/6d3eeba6-5560-4380-a6e9-f008a9112ac6Exploit, Third Party Advisory
• http://packetstormsecurity.com/files/166071/WordPress-WP-User-Frontend-3.5.25-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://plugins.trac.wordpress.org/changeset/2648715Patch, Third Party Advisory
• https://wpscan.com/vulnerability/6d3eeba6-5560-4380-a6e9-f008a9112ac6Exploit, Third Party Advisory

Published

Jan 24, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-25070The Block Bad Bots WordPress plugin before 6.88 does not pro…9.8
• CVE-2021-25071The WordPress plugin through 2.0.1 does not sanitise and esc…6.1
• CVE-2021-25072The NextScripts: Social Networks Auto-Poster WordPress plugi…6.5
• CVE-2021-25073The WP125 WordPress plugin before 1.5.5 does not have CSRF c…8.8
• CVE-2021-25074The WebP Converter for Media WordPress plugin before 4.0.3 c…6.1
• CVE-2021-25075The Duplicate Page or Post WordPress plugin before 1.5.1 doe…3.5
• CVE-2021-25077The Store Toolkit for WooCommerce WordPress plugin before 2.…6.1
• CVE-2021-25078The Affiliates Manager WordPress plugin before 2.9.0 does no…6.1
• CVE-2021-25079The Contact Form Entries WordPress plugin before 1.2.4 does …6.1
• CVE-2021-25080The Contact Form Entries WordPress plugin before 1.1.7 does …6.1
• CVE-2021-25081The Maps Plugin using Google Maps for WordPress plugin befor…6.5
• CVE-2021-25082The Popup Builder WordPress plugin before 4.0.7 does not val…8.8