User Registration & Membership EUVD-2026-103225

Exploitation requires that the plugin's registration form include a Checkbox Field and that the site expose the default frontend registration workflow, since the attack targets the Checkbox Field Value processed by ur_process_registration(). Because the user_registration_user_form_submit nopriv AJAX action runs without nonce validation, no authentication, account, or valid nonce is needed - any unauthenticated remote request reaches the sink against default configurations of the User Registration & Membership plugin versions ≤5.2.8. The principal limiting factor is that this is stored XSS: actual script execution depends on a victim (typically an admin reviewing registrations or any user viewing the injected page) later loading the affected content, and impact is confined to the browser context rather than direct server compromise.

This is a credible, above-average-priority web vulnerability but not an emergency-tier one. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2 High) is internally consistent with the description: the flaw is reachable over the network with low complexity and no privileges, because the nopriv AJAX action user_registration_user_form_submit reaches ur_process_registration() with no nonce validation, so any unauthenticated request hits the vulnerable Checkbox Field Value sink. The scope change (S:C) and low confidentiality/integrity impact correctly reflect stored XSS executing in other users' browser contexts rather than on the server itself. No EPSS score, no CISA KEV listing, and no public POC were provided - exploitation status is therefore 'no public exploit identified at time of analysis,' and the absence of these signals means the 7.2 should be read as an exposure-based rather than exploitation-confirmed priority. One nuance to verify: stored XSS normally requires a victim to later load the injected page, yet UI:N is scored because the attacker needs no interaction to plant the payload - realistic impact still depends on a victim (often an administrator) subsequently viewing the content. Net: a real, patch-worthy issue on internet-facing WordPress sites running this plugin, but there is no evidence of widespread active exploitation at this time.

An unauthenticated attacker sends a crafted POST to the user_registration_user_form_submit nopriv AJAX endpoint, supplying a malicious script as a Checkbox Field Value that bypasses nonce checks and insufficient sanitization. The payload is stored and later renders unescaped, executing in the browser of any user - potentially a logged-in administrator - who views the affected page, enabling session/cookie theft or admin-context actions. No public proof-of-concept was identified in the provided data.