EUVD-2026-102814
GHSA-x942-x6h9-wgpp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHarvest localized nonce from public page
-
DeliverySend AJAX request with malicious Referer header
-
ExploitPayload stored without sanitization
-
ExecutionVictim loads injected page
-
ImpactScript executes in victim browser
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable only against the PREMIUM build of User Registration PRO (the free WordPress.org distribution is not affected) at versions up to and including 6.2.9. No authentication is required (PR:N): the attacker injects via the HTTP Referer header into a vulnerable AJAX endpoint, and the nonce normally protecting that endpoint is localized into the page source of every front-end page for anonymous visitors, so it is fully obtainable without login. The practical limiting factors are twofold - the target must be running the paid premium build, and script execution is deferred until a user actually loads the injected page (stored XSS), meaning impact depends on a victim visiting the affected page. |
| Impact | Multiple signals converge on a moderate, not top-tier, priority. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2 HIGH) describes a remotely reachable, low-complexity, unauthenticated stored XSS with a scope change, which is genuinely attractive to attackers because the injection nonce is exposed to anonymous visitors, removing the usual authentication/nonce barrier. However, impact is capped at C:L/I:L/A:N (script execution in victims' browsers, not server compromise), so this is a cross-site scripting issue rather than RCE. Crucially, there is no EPSS score, no CISA KEV listing, and no public exploit in the provided data, so exploitation is currently unproven - no public exploit identified at time of analysis. A key scoping caveat: the flaw exists ONLY in the premium build, not the free WordPress.org distribution, which materially shrinks the exploitable population versus what the plugin's overall install base would suggest. Net: a legitimate HIGH-severity bug worth patching promptly on premium installs, but not an emergency on the level of an actively exploited KEV entry. |
| Exploit ScenarioDerived | An unauthenticated attacker scrapes the nonce localized into the page source of any front-end page, then sends a crafted request to the vulnerable AJAX endpoint with a malicious HTTP Referer header that is stored without sanitization. When a user (including an administrator viewing registrations) later loads the page where that data is rendered, the injected script executes in their browser session. No public exploit code is identified at time of analysis, but the low complexity and exposed nonce make weaponization straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Stored cross-site scripting in the premium build of the User Registration PRO WordPress plugin (all versions up to and including 6.2.9) lets unauthenticated attackers inject arbitrary JavaScript through the HTTP Referer header into a vulnerable AJAX endpoint, with the payload persisting so it executes whenever a victim loads the injected page. The nonce that normally protects that endpoint is localized into the page source of every front-end page for anonymous visitors, so no account or credentials are required, although the attacker must target a site running the paid premium build - the free WordPress.org distribution is not affected - and the payload only fires once a user actually visits the compromised page. No public exploit code and no confirmed active exploitation were identified at time of analysis; the assessed severity of 7.2 reflects the scope change and the limited, though real, confidentiality and integrity impact of script execution in a victim's browser.
RemediationAI
The primary fix is to update the premium build of User Registration PRO to a release later than 6.2.9; the data available here does not specify an exact patched version number, so administrators should consult the vendor changelog at https://wpuserregistration.com/changelog/ (referenced alongside the Wordfence advisory https://www.wordfence.com/threat-intel/vulnerabilities/id/493ac933-f2b3-487b-8fc7-af2df9b0d460?source=cve) to confirm the first fixed release and verify their installed version against it, and should remember that only the paid premium build requires action. If immediate upgrading is not possible, deploy a WAF rule that inspects the HTTP Referer header and blocks requests containing script or HTML markup on the plugin's front-end AJAX endpoints - accepting that aggressive Referer filtering can break legitimate analytics, redirect and anti-hotlinking behaviour - and consider temporarily disabling or restricting the plugin's front-end AJAX registration/login/profile actions if they are not in active use, with the trade-off that registration and login forms may stop functioning for visitors. Because this is a stored XSS, also scan the site's database and cached pages for injected script payloads and purge page/object caches after patching so previously stored fragments are not still served; restricting access to the affected pages or requiring authenticated access during the exposure window reduces victim visits but does not remove the underlying injection path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a CWE-79 improper neutralization of input during web page generation (cross-site scripting) issue in a commercial WordPress plugin from WPEverest. User Registration PRO provides custom registration forms, login forms and user profile functionality, and exposes AJAX handlers through the standard WordPress admin-ajax.php mechanism. The vulnerable handler reads attacker-controlled data from the HTTP Referer header and persists it without adequate input sanitization, then renders it without output escaping, producing a stored XSS that executes in the browser context of any user who later views the affected page. WordPress normally protects such AJAX actions with a nonce, but here the nonce is localized into the page source of every front-end page for anonymous visitors, so it is trivially scrapable and provides no effective barrier - consistent with the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector, which scores the issue as remotely exploitable by an unauthenticated attacker with no user interaction required on the attacker's side. The scope change (S:C) reflects that the injected script runs under the site's origin, and the reported CPE (wpeverest:user_registration_pro_-_custom_registration_form,_login_form,_and_user_profile_wordpress_plugin) confirms the affected component is the commercial build rather than the WordPress.org free release. Wordfence is credited as the reporting source.
Know when User Registration Pro Custom Registration Form Login Form And User Profile Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated nonce is exposed to anonymous users so PR:N and AC:L; stored XSS executes in other users' browsers giving S:C with C:L/I:L and no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The User Registration PRO - Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Referer Header in all versions up to, and including, 6.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is present only in the premium build of the plugin and is not present in the free WordPress.org distribution. The nonce required to call the vulnerable AJAX endpoint is localized into the page source of every front-end page for anonymous visitors, making it fully obtainable by unauthenticated attackers.
Executive ViewAI
A stored cross-site scripting flaw affects all versions up to and including 6.2.9 of the premium build of the User Registration PRO WordPress plugin, allowing injected JavaScript to persist on affected pages and execute in the browsers of visitors who load them, without any account or credentials being needed by the attacker. The free WordPress.org distribution is unaffected, so exposure is limited to organizations running the paid premium build, but for those sites the injection can reach ordinary front-end visitors and potentially manipulate sessions or displayed content. Leadership should care because the defect sits on customer-facing pages, no vendor fix is currently available, and remediation depends on interim controls rather than a simple upgrade.
No vendor-released patch identified at time of analysis. Interim mitigations: deploy WAF or reverse-proxy rules that strip or reject JavaScript content in the Referer header and block anomalous requests to the plugin's AJAX endpoints; enforce a restrictive Content Security Policy on front-end pages to prevent inline script execution; restrict or disable the affected front-end AJAX endpoint where operationally feasible; closely monitor and audit stored content and visitor sessions for signs of injected script; and consider removing or replacing the premium plugin until a fix is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB