CVE-2026-19116

HighCVSS 8.8/10Last modified Sep 3, 2026

Description

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead to remote code execution when a suitable gadget chain is present on the site.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Sep 2, 2026
Last modified: Sep 3, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-191179.8Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate a CVE-2026-191187.5A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution. Expl CVE-2026-19126.4The Citations tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'code' parameter in the 'ctdoi' shortcode in a CVE-2026-191258.1The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is d CVE-2026-191276.5An issue in the billing and license activation subsystem allows remote attackers to bypass payment authorization workflows. By exploiting in CVE-2026-19136.4The Gallagher Website Design plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's login_link shortcode in all CVE-2026-191305.8A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the CVE-2026-191355.4A JEXL expression sandbox bypass exists in multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user can submit CVE-2026-191367.8A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese marke CVE-2026-191378.3Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer proce CVE-2026-191388.3Heap buffer overflow in CrashReporting in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer p CVE-2026-191397.4Race in CredentialProvider in Google Chrome on Windows prior to 151.0.7922.109 allowed a local attacker to perform OS-level privilege escala