What is the CVSS score of CVE-2026-42652?

CVE-2026-42652 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of User Registration are affected by CVE-2026-42652?

The wpeverest User Registration plugin for WordPress (versions up to 5.1.5) contains a reflected cross-site scripting vulnerability that allows remote attackers to inject malicious JavaScript through…

How to fix or mitigate CVE-2026-42652?

Within 24 hours, disable or deactivate the wpeverest User Registration plugin on all affected WordPress installations. Within 7 days, conduct an inventory of all WordPress sites running the plugin and determine if users have been exposed to malicious links; review access logs and security events for signs of exploitation. Within 30 days, either update to a patched version once released by the vendor, or implement Web Application Firewall rules and Content Security Policy headers to block reflected XSS payloads, and monitor the vendor advisory channel for patch availability.

User Registration CVE-2026-42652

EUVD-2026-26219 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-04-29 Patchstack

WordPress XSS User Registration Wordpress Plugin Wpeverest

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Reflected XSS needs no auth (PR:N) but requires the victim to click a link (UI:R); script runs cross-context (S:C) with limited confidentiality/integrity impact and no realistic availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 02:31 vuln.today

EUVD ID Assigned

Apr 29, 2026 - 11:30 euvd

EUVD-2026-26219

CVE Published

Apr 29, 2026 - 10:40 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration user-registration allows Reflected XSS.This issue affects User Registration: from n/a through <= 5.1.5.

AnalysisAI

Reflected cross-site scripting in the wpeverest User Registration plugin for WordPress (all versions up to and including 5.1.5) lets remote attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. The CVSS scope-change rating (7.1) reflects that injected script can act beyond the vulnerable component, but practical impact is bounded by the privileges of whichever user is lured into clicking. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.03%, 10th percentile), and CISA SSVC records no known exploitation.

Technical ContextAI

User Registration is a WordPress plugin (CPE cpe:2.3:a:wpeverest:user_registration) that adds front-end registration, login, and profile forms to WordPress sites. The flaw is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) reflected XSS: attacker-controlled input supplied in a request parameter is echoed back into the generated HTML response without proper output encoding or sanitization, so the browser parses it as executable script. Because reflection occurs server-side and is returned unsanitized, the payload runs in the security context of the WordPress site origin, enabling session-riding actions against any user tricked into loading the URL.

RemediationAI

Upgrade the User Registration plugin to a release later than 5.1.5 once available from WPEverest; the input data does not name a confirmed fixed version, so consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/user-registration/vulnerability/wordpress-user-registration-plugin-5-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve) and the plugin's WordPress.org changelog for the exact patched build before deploying. Until patched, deploy a WAF (Patchstack, Wordfence, or ModSecurity with OWASP CRS) with XSS rules to filter reflected script in request parameters, noting that such rules can be bypassed and may produce false positives on legitimate form input. As additional compensating controls, enable a restrictive Content-Security-Policy header to limit inline script execution (test carefully, as strict CSP can break plugin functionality), restrict access to registration/login endpoints where feasible, and caution users against clicking untrusted links to the site.