User Registration EUVD-2026-98370

Exploitation requires an authenticated low-privilege account (PR:L) on a site running ThemeGrill User Registration version 5.2.8 or earlier - realistically obtained because the plugin's purpose is self-service user registration, often with open sign-up enabled. The stored payload only executes when a victim (typically an administrator reviewing user/registration data) loads the affected page (UI:R), so a human view-step is mandatory and the attack is not automatable against an idle target. Limiting factors: attacker must be able to register/authenticate, the injected content must be rendered to a higher-privileged user, and sites that disable open registration or restrict the vulnerable field substantially reduce exposure.

This is a stored cross-site scripting (CWE-79) flaw in the ThemeGrill User Registration WordPress plugin, scored CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The network vector and low attack complexity make delivery trivial, but two factors temper real-world risk: PR:L means an attacker must first hold a low-privilege authenticated account (consistent with a registration plugin where self-service account creation is the feature), and UI:R means a victim - typically an administrator - must view the injected content for the payload to fire. The scope change (S:C) reflects that injected script executes in the victim's authenticated browser context, enabling session/credential theft or admin action forgery, which is why confidentiality, integrity and availability each carry a Low impact. No EPSS score, CISA KEV listing, POC, or SSVC decision data were supplied, so exploitation signals are absent rather than negative - status is 'no public exploit identified at time of analysis.' On balance this is a credible but not emergency priority: a classic authenticated stored-XSS requiring victim interaction, warranting routine patching rather than crisis response. Missing data to note: no EPSS/KEV/POC provided, and the single Patchstack reference does not detail the exact injection point or whether unauthenticated registration is required.

An attacker self-registers a low-privilege account via the User Registration plugin and submits a registration or profile field containing a malicious script payload, which the plugin stores without proper neutralization. When a site administrator later opens the user-management or registration review screen, the stored script executes in the admin's authenticated browser session, allowing session hijacking or admin-level actions. No public exploit code was identified in the provided data.