CVE-2024-13569: 
WordPress vulnerability analysis and mitigation

The Front End Users WordPress plugin through version 3.2.32 contains a Reflected Cross-Site Scripting (XSS) vulnerability. The vulnerability stems from the plugin's failure to properly sanitize and escape a parameter before outputting it back in the page. This security flaw was discovered by Hassan Khan Yusufzai (Splint3r7) and was publicly disclosed on April 1, 2025 (WPScan Details).

The vulnerability has been assigned a CVSS v3.1 base score of 7.1 (High) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The issue is classified as CWE-79 (Cross-Site Scripting) and falls under the OWASP Top 10 category A7: Cross-Site Scripting (XSS). The vulnerability can be exploited through the WordPress admin panel by manipulating specific parameters in the URL (WPScan Details).

This vulnerability could be exploited against high-privilege users such as administrators. When successfully exploited, it allows attackers to execute arbitrary JavaScript code in the context of the targeted user's browser session (CVE Details).

Currently, there is no known fix available for this vulnerability in the Front End Users WordPress plugin (WPScan Details).