Stored Cross-Site Scripting in User Registration PRO Plugin for WordPress
CVE-2026-87111

7.2HIGH

Key Information:

Vendor

WordPress
Status
User Registration Pro – Custom Registration Form, Login Form, And User Profile WordPress Plugin
Vendor
CVE Published:
16 October 2026

What is CVE-2026-87111?

The User Registration PRO plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability through the HTTP Referer Header across all versions up to and including 6.2.9 due to inadequate input sanitization and output escaping. This flaw allows unauthenticated attackers to inject malicious scripts that execute whenever a user accesses a compromised page. The premium version of the plugin contains this vulnerability, while the free version available on WordPress.org does not. The required nonce for vulnerable AJAX calls is included in the source of every front-end page, making it easily accessible to attackers, escalating the risk of exploitation.

Affected Version(s)

User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin 0 <= 6.2.9

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wpuserregistration.com/changelog/

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

andrea bocchetti
.