Description
WordPress Plugin WP User Frontend-Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission is prone to a supply chain attack because of the Polyfill JavaScript library used. The ownership of the library was taken over by malicious threat actors that used the service to redirect victims to malicious websites. WordPress Plugin WP User Frontend-Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission version 4.0.7 is affected; prior versions may also be affected.
Remediation
Update to plugin version 4.0.8 or latest
References
https://sansec.io/research/polyfill-supply-chain-attack
https://plugins.svn.wordpress.org/wp-user-frontend/trunk/readme.txt
Related Vulnerabilities
Oracle Database Server CVE-2019-2517 Vulnerability (CVE-2019-2517)
MySQL CVE-2014-6494 Vulnerability (CVE-2014-6494)
WordPress Plugin Related Posts for WordPress Cross-Site Scripting (1.8.1)
WordPress Plugin BuddyPress Multiple Vulnerabilities (9.0.0)
MongoDb Missing Authorization Vulnerability (CVE-2026-25609)