User Registration CVE-2026-25467

The specific injectable feature, field, or configuration is not described in the available sources, and the trigger is not detailed beyond 'Basic XSS' allowing code/content injection in User Registration ≤5.3.0. Per the CVSS vector it is reachable over the network without authentication (PR:N) against affected installations. LIMITING FACTORS: as an XSS/content-injection class flaw, successful impact realistically depends on the injected script being rendered in a victim's browser (victim viewing the affected page), despite the vector listing UI:N; impact is confined to low confidentiality (C:L) with no integrity or availability effect per the supplied vector, and exploitation is bounded to sites running the vulnerable plugin version.

This is a medium-severity (CVSS 5.3) Basic XSS / content-injection issue (CWE-80) in the ThemeGrill User Registration WordPress plugin, affecting versions up to and including 5.3.0, reported by Patchstack. The supplied CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates remote, low-complexity, unauthenticated reachability with only low confidentiality impact and no integrity or availability impact. There is no KEV listing, no EPSS score and no EPSS percentile in the input, and no verified exploit code - exploitation status is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', i.e. a scheduled-remediation priority rather than act_now/emergency. CONFLICT TO VERIFY: the CVSS vector sets UI:N and S:U with only C:L, which is atypical for an XSS/code-injection flaw - stored or reflected XSS normally requires a victim to render the payload (UI:R) and usually causes a scope change (S:C) with some integrity impact; this suggests the score may understate or mis-model the real mechanism, so treat the exact impact as unverified. Overall this reads as a genuine but modest-priority web-application flaw, not a high-urgency widespread-exploitation event; the absence of EPSS and PoC confirmation means exploitation likelihood cannot be quantified from the provided data.

An attacker submits a crafted script-bearing value into an input processed by the User Registration plugin on a WordPress site running version 5.3.0 or earlier, and the unsanitized HTML/script is later rendered in a browser, executing in that page's context (e.g. to run attacker script against a visitor or administrator). The exact injectable field and whether the payload is stored or reflected are not described in the available sources. No public exploit has been identified; per the CVSS vector reachability is network-based and does not require authentication (PR:N), though the vector's UI:N conflicts with the user-rendering typically needed for XSS.