User Registration EUVD-2026-102049

Exploitation requires an authenticated account on the target site (CVSS PR:L) with access to a User Registration plugin input field that persists data, plus subsequent user interaction (UI:R) - a victim such as an administrator must view the page where the stored payload renders. Limiting factors: the attacker cannot act fully unauthenticated, the payload only fires when a privileged/other user loads the affected view, and impact is bounded to the browser session context rather than direct server compromise. Applies to User Registration versions up to and including 5.2.8. The specific vulnerable field/parameter is not named in the available data and should be confirmed against the Patchstack advisory.

This is a moderate-severity Stored XSS (CWE-79) in the ThemeGrill User Registration WordPress plugin, rated CVSS 6.5. The provided CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) indicates network-reachable, low-complexity exploitation but requires at least low-level authenticated privileges (PR:L) and victim user interaction (UI:R), with a scope change (S:C) consistent with injected script executing in another user's/admin's browser context. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no evidence of active exploitation or weaponization - this appears to be a routine researcher-reported (Patchstack) stored XSS rather than an urgent in-the-wild threat. The low per-component impact (C:L/I:L/A:L) and the authentication plus user-interaction prerequisites meaningfully reduce real-world risk below what a 'network' vector alone might suggest. Net assessment: a genuine but not high-priority issue - patch in normal cycle; the main escalation path is a low-privileged registered user storing script that later fires in an administrator's session.

A low-privileged registered user submits crafted input through a User Registration plugin field (e.g. a profile/registration form value) that is stored without proper neutralization. When a site administrator or another user later views that data in the dashboard, the injected JavaScript executes in their authenticated browser session, potentially enabling session/cookie theft or actions in the victim's context. No public exploit code is identified at time of analysis.