What is the CVSS score of CVE-2026-1503?

CVE-2026-1503 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-1503?

Organizations using login_register should be aware of moderate risk from CVE-2026-1503, a cross-site request forgery vulnerability rated CVSS 4.3.

How to fix or mitigate CVE-2026-1503?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Cross-Site Request Forgery to and apply vendor patches as part of regular patch cycle. Verify anti-CSRF tokens are enforced.

WordPress CVE-2026-1503

EUVD-2026-14181 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-03-21 Wordfence

GHSA-p352-rg87-vcp2

WordPress XSS CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14181

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 4.3

DescriptionCVE.org

The login_register plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 1.2.0. This is due to missing nonce validation on the settings page and insufficient input sanitization and output escaping on the 'login_register_login_post' parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page via a forged request granted they can trick an administrator into performing an action such as clicking on a link.

AnalysisAI

The login_register plugin for WordPress versions up to 1.2.0 contains a combined Cross-Site Request Forgery (CSRF) and Stored Cross-Site Scripting (XSS) vulnerability due to missing nonce validation and insufficient input sanitization on the settings page. Unauthenticated attackers can craft malicious links to trick administrators into injecting arbitrary JavaScript that persists and executes for all users accessing affected pages. While the CVSS score is moderate at 4.3, the vulnerability requires user interaction (administrator click) but enables persistent script injection with potential for credential theft or further compromise.

Technical ContextAI

The vulnerability exists in the login_register plugin (CPE: cpe:2.3:a:frankkoenen:plugin_name:_login_register) maintained by Frank Koenen for WordPress. The root cause is classified under CWE-352 (Cross-Site Request Forgery) combined with insufficient output escaping and input sanitization of the 'login_register_login_post' parameter. The vulnerable code is located in login_register_admin.php at lines 12, 14, and 69 as confirmed by the WordPress plugin repository. The plugin fails to implement WordPress security best practices: it does not validate nonces (WordPress's CSRF protection mechanism) before processing form submissions on the settings page, nor does it properly escape user-controlled input before rendering it to the DOM. This allows attackers to chain CSRF attacks with stored XSS to achieve persistent payload injection.

RemediationAI

Update the login_register plugin to a version newer than 1.2.0 immediately, as the vulnerability affects all versions up to 1.2.0 inclusive. Consult the plugin's official repository or developer for available patched versions. Until a patch is available or applied, site administrators should consider temporarily disabling the login_register plugin or restricting access to the settings page through network controls (IP whitelisting for administrative access). Additionally, implement Content Security Policy (CSP) headers to mitigate the impact of any injected scripts, and ensure all WordPress administrators use strong, unique passwords to reduce the likelihood of account compromise if any scripts target credential harvesting. Review the Wordfence advisory and plugin repository for post-patch release notes: https://www.wordfence.com/threat-intel/vulnerabilities/id/8c82d209-3c69-4d6e-a129-d519f6601540?source=cve.