Stored Cross-Site Scripting Vulnerability in User Registration Plugin for WordPress
CVE-2026-96660

7.2HIGH

Key Information:

Vendor

WordPress
Status
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
Vendor
CVE Published:
17 October 2026

What is CVE-2026-96660?

The User Registration & Membership plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitization and output escaping. This issue exists in all versions up to and including 5.2.8, allowing unauthenticated attackers to inject arbitrary scripts into web pages. When these compromised pages are accessed by users, the malicious scripts execute without their consent. The vulnerability is exacerbated by the absence of nonce validation in the nopriv AJAX action user_registration_user_form_submit, allowing unauthorized requests to bypass security and execute vulnerable code.

Affected Version(s)

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder 0 <= 5.2.8

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/user-registrat...
https://plugins.trac.wordpress.org/browser/user-registrat...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kuba
.