User Registration CVE-2026-42652

Exploitation requires victim user interaction: the target must click or load an attacker-crafted URL aimed at the User Registration plugin's vulnerable parameter (UI:R in the CVSS vector). No authentication or special privileges are needed by the attacker (PR:N), and no server-side configuration change is required since the plugin's registration/login forms are typically exposed on the public front end. The reflected (non-persistent) nature limits the attack to one victim per delivered link - the payload is not stored and does not self-propagate - and impact is bounded by the privileges of whichever user is lured, making the phishing/social-engineering delivery step the primary limiting factor.

The signals are consistent and point to low real-world urgency despite the 7.1 'High' CVSS. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L shows network reach with no privileges required, but critically requires user interaction (UI:R) - a victim must click a crafted link - which is why impact metrics are only Low and reflected (not stored) XSS is not self-propagating. EPSS is 0.03% (10th percentile), and CISA's SSVC framework rates Exploitation: none, Automatable: no, Technical Impact: partial, all reinforcing that this is not automatable or mass-exploitable. No POC and no KEV listing. The scope-change (S:C) and A:L values are somewhat generous for a reflected XSS and appear to reflect Patchstack's conservative scoring; the realistic worst case is theft of session context or forced actions for a single lured user, not server compromise. This is a routine 'patch on normal cadence' issue, not an emergency.

An attacker crafts a URL to the target WordPress site embedding a malicious script payload in a parameter processed by the User Registration plugin, then delivers it via phishing email, forum post, or ad. When a logged-in administrator or ordinary user clicks the link, their browser reflects and executes the script in the site's origin, allowing session hijacking, actions performed as that user, or data harvesting. No public exploit code is identified at time of analysis, and success depends on the victim taking the bait (UI:R).