PLUGIN SECURITY
Is WPFront User Role Editor safe?
Easily allows you to manage WordPress user roles. You can create, edit, delete and manage capabilities, also copy existing roles.
What this plugin does
- Slug:
wpfront-user-role-editor - Author: Syam Mohan
- 30000+ active installs
- 90/100 rating (65 reviews on wordpress.org)
- 989822 all-time downloads
- On WordPress.org since 2014-03-02
capability managerrole editorsecurityUser Accessuser permissions
Maintenance status
- Latest known version: 4.2.4
- Last updated: 2026-08-19 7:30am GMT
- Tested up to WordPress: 7.1
- Requires PHP: 7.0+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
4 known CVEs on file for WPFront User Role Editor.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2024-2931 | WPFront User Role Editor [wpfront-user-role-editor] < 4.1.0 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 4.3 | < 4.1.0 | 4.1.0 | 2024-04-01 | ✓ fixed in latest |
| CVE-2021-24984 | WPFront User Role Editor [wpfront-user-role-editor] < 3.2.1.11184 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 3.2.1.11184 | 3.2.1.11184 | 2021-11-23 | ✓ fixed in latest |
| — | WPFront User Role Editor [wpfront-user-role-editor] < 3.2.1.11184 | — | Unknown | < 3.2.1.11184 | 3.2.1.11184 | 2021-11-23 | ✓ fixed in latest |
| — | WPFront User Role Editor [wpfront-user-role-editor] < 4.2.2 | Cross-Site Request Forgery (CSRF) | High 8.8 | < 4.2.2 | 4.2.2 | 0000-00-00 | ✓ fixed in latest |
| — | WPFront User Role Editor [wpfront-user-role-editor] < 4.2.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 4.2.4 | 4.2.4 | 0000-00-00 | ✓ fixed in latest |
| CVE-2025-3064 | WPFront User Role Editor < 4.2.2 - Cross-Site Request Forgery to Privilege Escalation via whitelist_options Function | — | Unknown | < 4.2.2 | 4.2.2 | — | ✓ fixed in latest |
| CVE-2025-60102 | WPFront User Role Editor < 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting | — | Unknown | < 4.2.4 | 4.2.4 | — | ✓ fixed in latest |
How to fix it
Keep WPFront User Role Editor updated — 4.2.4 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- User Role by BestWebSoft – Add and Customize Roles and Capabilities in WordPress — 3000+ active installs — 72/100 (12) — max PHP 8.4
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.