WPFront User Role Editor

WPFront User Role Editor has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2025; all 5 are fixed as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high. 2025 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (60%). Other recurring categories include Cross-Site Request Forgery (CSRF), Exposure Of Sensitive Information To An Unauthorized Actor.

Every one of the 5 issues recorded for WPFront User Role Editor has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, most of them (2) reported by ZhongFu Su. WPFront User Role Editor is installed on roughly 30,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium

6.3/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all WPFront User Role Editor vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2025-3064

WPFront User Role Editor <= 4.2.1 - Cross-Site Request Forgery to Privilege Escalation via whitelist_options Function

Read the full analysis

Vulnerability Records

5 records


2025-09-26 00:00	WPFront User Role Editor <= 4.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting WPFront User Role Editor <= 4.2.3	`CVE-2025-60102`	6.4 Medium	zaim	Yes
2025-04-07 19:49	WPFront User Role Editor <= 4.2.1 - Cross-Site Request Forgery to Privilege Escalation via whitelist_options Function WPFront User Role Editor <= 4.2.1	`CVE-2025-3064`	8.8 High	stealthcopter	Yes
2024-04-01 00:00	WPFront User Role Editor <= 3.2.1.11184 - Limited Information Exposure WPFront User Role Editor <= 3.2.1.11184	`CVE-2024-2931`	4.3 Medium	1337_Wannabe	Yes
2021-11-23 00:00	WPFront User Role Editor < 3.2.1.11184 - Reflected Cross-Site Scripting WPFront User Role Editor < 3.2.1.11184	`N/A`	6.1 Medium	ZhongFu Su	Yes
2021-11-23 00:00	WPFront User Role Editor <= 3.2.0 - Reflected Cross-Site Scripting WPFront User Role Editor <= 3.2.0	`CVE-2021-24984`	6.1 Medium	ZhongFu Su	Yes

Showing 1–5 of 5 reports

Latestv4.2.5

WPFront User Role Editor

Author

Syam Mohan

4.5(65)

90/100

Last Updated

2026-08-19 (25d ago)

Active Installs

30,000+

Downloads

992,081

Requires WP

5.1+

Requires PHP

7.0+

Tested up to

WP 7.1

Created

2014-03-02 (13y ago)

WPFront User Role Editor plugin allows you to easily manage WordPress user roles within your site. You can create, edit or delete user roles and manage role capabilities. Features Create new roles. Edit or rename existing roles. Clone existing roles. Manage capabilities. Allows you to add role capabilities. Change default user role. Add or Remove capabilities. Restore role. Assign multiple roles. Migrate users. Navigation menu permissions basic. Widget permissions basic. Login redirect basic. Admin menu editor. [PRO] Media library permissions. [PRO] User level permissions. [PRO] Navigation menu permissions advanced. [PRO] Widget permissions advanced. [PRO] Login redirect advanced. [PRO] Post/Page extended permissions. [PRO] Custom post type permissions. [PRO] Content restriction shortcodes. [PRO] Import/Export. [PRO] Multisite support. [PRO] Compare User Role Editor Pro Spanish tutorial

View on WordPress.org