WP Frontend Profile

WP Frontend Profile has 8 disclosed vulnerabilities in the WordSec catalog, reported between 2016 and 2026; 6 are fixed and 2 remain unpatched as of September 2026. Their average CVSS score is 7.1, and the most serious one scores 9.8 out of 10. Severity breakdown: 2 critical and 1 high. 2026 was the busiest year with 2 disclosures.

The most common weakness is Missing Authorization, behind 3 of the records (38%). Other recurring categories include Cross-Site Request Forgery (CSRF), Cross-Site Scripting.

6 of the records (75%) have a vendor fix, while 2 remain unpatched. The oldest unresolved one dates back to 2023.

5 independent researchers contributed these findings, most of them (2) reported by Phil Wylie (mustardbees). WP Frontend Profile is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.

Strategic Overview

Avg CVSSHigh

7.1/ 10

Patch Coverage75%

Open

Fixed

Get automatic notifications for all WP Frontend Profile vulnerabilities before they are exploited.

Most severe open issueCVSS 6.1CVE-2023-33999

Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get

Read the full analysis

Vulnerability Records

8 records


2026-03-06 11:21	WP Frontend Profile <= 1.3.8 - Cross-Site Request Forgery to Unauthorized User Account Approval or Rejection WP Frontend Profile <= 1.3.8	`CVE-2026-1644`	4.3 Medium	johska	Yes
2026-02-23 00:00	Frontend Profile <= 1.3.9 - Missing Authorization WP Frontend Profile <= 1.3.9	`CVE-2026-39688`	5.3 Medium	Legion Hunter	No
2023-12-27 00:00	WP Frontend Profile <= 1.3.1 - Unauthenticated Privilege Escalation WP Frontend Profile <= 1.3.1	`CVE-2023-51483`	9.8 Critical	Rafie Muhammad	Yes
2023-07-18 00:00	Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get WP Frontend Profile 1.2.1 – 1.3.0	`CVE-2023-33999`	6.1 Medium	Rafie Muhammad	No
2022-03-04 00:00	Freemius SDK <= 2.4.2 - Missing Authorization Checks WP Frontend Profile < 1.2.5	`CVE-2022-4974`	6.3 Medium	Anonymous	Yes
2020-05-19 00:00	WP Frontend Profile <= 1.2.1 - Cross-Site Request Forgery WP Frontend Profile <= 1.2.1	`N/A`	8.8 High	Julio Potier	Yes
2016-09-14 00:00	WP Front End Profile <= 0.2.1 - Privilege Escalation WP Frontend Profile <= 0.2.1	`CVE-2019-15111`	9.8 Critical	Phil Wylie (mustardbees)	Yes
2016-09-14 00:00	WP Front End Profile <= 0.2.1 - Stored Cross-Site Scripting WP Frontend Profile <= 0.2.1	`CVE-2019-15110`	6.4 Medium	Phil Wylie (mustardbees)	Yes

Showing 1–8 of 8 reports

Latestv1.3.9

WP Frontend Profile

Author

Glowlogix

4.3(9)

86/100

Last Updated

2026-02-21 (7mo ago)

Active Installs

100+

Downloads

24,289

Requires WP

4.0.1+

Requires PHP

5.2.17+

Tested up to

WP 6.8.8

Created

2014-12-06 (12y ago)

WP Frontend Profile gives you the ability to add a extensible user profile section to the frontend of your WordPress website. By default the plugin adds two tabs to the frontend profile. One of these tabs, titled profile, allows a user to edit their user data including email, first and last names, URL and bio (description). The password tab allows a user to change their password for the site. Plugin Extensibility As the frontend profile is rendered with tabs you can easily add your own tabs with your own fields to store user meta data. Tabs and fields are added through filters and all the saving of the data is taken care of for you. You can add the following field types: WYSIWYG Select Multi Select Radio Text Area Checkbox Password Email Text See FAQs for how to add our own fields and tabs. Profile Output To output the frontend profile feature you can use the following shortcodes in editor: Profile page [wpfep-profile] Edit profile [wpfep] Register page [wpfep-register] Login page [wpfep-login] Features Added Login Widget Addon for Mailchimp Added Content Restriction feature for paid members.

View on WordPress.org