User Registration CVE-2026-27061

Exploitation requires the attacker to hold an authenticated subscriber-level account on a target WordPress site running the User Registration plugin at version 5.3.0 or earlier (PR:L), which in turn requires that user registration be enabled on the site. The attack is not self-contained: a victim must view the attacker-injected content for the script to fire (UI:R), and the impact manifests in the victim's browser context (scope change). These limiting factors - mandatory low-privilege authentication plus required victim interaction - meaningfully constrain real-world exploitation compared to an unauthenticated, zero-interaction flaw. The exact triggering field and whether the payload is stored or reflected are not described in the available sources.

This is a moderate-severity stored/reflected Cross-Site Scripting flaw (CWE-79) in the WordPress 'User Registration' plugin (wpeverest) at versions ≤ 5.3.0, carrying a CVSS 6.5 score. The supplied vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L indicates network-reachable, low-complexity exploitation, but it requires attacker-held low privileges (PR:L - a subscriber-level account) AND victim interaction (UI:R), with a scope change (S:C) consistent with script executing in another user's browser session. No EPSS score was provided, so real-world exploitation probability cannot be quantified from the input. The CVE is NOT listed in CISA KEV, and no confirmed proof-of-concept or working exploit code is present in the data - the single reference is a Patchstack advisory entry, not exploit code. The vuln.today priority is 'this_month,' not act_now or emergency, which aligns with a genuine-but-non-urgent issue: a real vulnerability warranting scheduled patching rather than an incident response. Net assessment: a legitimate priority-for-patching finding whose real-world risk is tempered by the dual prerequisites of an authenticated subscriber account and required user interaction, keeping it below the tier of unauthenticated remote-code-execution emergencies.

An attacker who can register a subscriber-level account on a WordPress site running User Registration ≤ 5.3.0 submits a crafted input containing a malicious script payload through a registration-related field. When a higher-privileged user such as an administrator later views that attacker-controlled content in the dashboard, the script executes in the victim's authenticated browser session (scope change), potentially enabling session/token theft or actions on the victim's behalf. No verified public exploit code is identified in the available data.