User Registration Membership Free Paid Memberships Subscriptions Content Restriction User Profile Custom User Registration Login Builder
Monthly
Arbitrary shortcode execution in the User Registration & Membership WordPress plugin through 5.2.8 lets unauthenticated attackers place registered shortcodes into the HTTP Referer header so they are executed when a restricted page renders a Content Restriction message containing the {{referrer_url}} smart tag. The vulnerable path is UR_Smart_Tags::process(), where sanitize_text_field() leaves shortcode delimiters intact before the message is passed to apply_shortcodes()/do_shortcode(); impact is bounded to shortcodes registered on the target site. Exploitation requires the non-default Content Restriction configuration described above; no public exploit was identified at time of analysis, no CISA KEV confirmation was provided, and no EPSS score was supplied.
Stored cross-site scripting in the User Registration & Membership WordPress plugin (all versions up to and including 5.2.8) lets unauthenticated remote attackers plant arbitrary JavaScript by submitting a crafted Checkbox Field value through the plugin's public registration form. Because the nopriv AJAX action user_registration_user_form_submit reaches ur_process_registration() without any nonce validation, no account or valid token is required - the payload is persisted and later executes in the browser of anyone who views the injected page, most consequentially an administrator reviewing registrations. There is no public exploit code or CISA KEV entry at time of analysis, and the assessed impact is bounded to browser-context confidentiality and integrity (CVSS 7.2, scope changed) rather than server compromise, making this above-average priority but not emergency-tier.
Cross-site request forgery in the WordPress plugin User Registration & Membership through 5.2.8 lets unauthenticated attackers trick a logged-in administrator into approving pending registrations or denying arbitrary user accounts, potentially locking targeted users out of the site. Exploitation requires the administrator to click a crafted link or visit a malicious page (UI:R) and depends on an empty new_role parameter that bypasses the plugin's nonce check and WordPress core's bulk-user nonce validation. Impact is limited to unauthorized registration-status changes (low integrity, no confidentiality or availability impact); no public exploit identified at time of analysis.
Authenticated attackers holding only subscriber-level access can execute arbitrary WordPress shortcodes on sites running the WPEverest User Registration & Membership plugin in all versions up to and including 5.2.8, because an action passes an unvalidated value straight into do_shortcode without checking it first. The flaw is rated CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and there is no public exploit identified at time of analysis - it is not confirmed actively exploited (CISA KEV). Impact is bounded, but the practical risk is elevated on the many sites that leave open user registration enabled, since an attacker can simply self-provision the required subscriber account and then trigger the vulnerable shortcode path; sites that disable open registration meaningfully reduce exposure.
Payment bypass in WPEverest's User Registration & Membership WordPress plugin (versions up to and including 5.2.0) allows unauthenticated remote attackers to activate paid memberships without completing payment. The vulnerability stems from missing authorization checks in the confirm_payment() function (CWE-862), which fails to validate that a legitimate payment transaction occurred before granting membership access. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack is low-complexity and requires no authentication, making it trivially reachable by any internet-connected adversary.
Insecure Direct Object Reference in WPEverest's User Registration & Membership WordPress plugin (all versions through 5.1.5) allows deletion of arbitrary media attachments by exploiting missing ownership validation on user-controlled attachment IDs. Authenticated users at subscriber level or above can permanently destroy any media file uploaded by any other user, including administrators, by submitting a crafted attachment ID to the plugin's frontend handler. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV; however, the low barrier to exploitation - any registered site user qualifies - elevates practical risk on membership-driven WordPress sites.
The User Registration & Membership plugin for WordPress versions up to 5.1.4 allows authenticated attackers with Contributor-level access to append shortcode content to arbitrary pages without authorization due to a missing capability check in the embed_form_action() AJAX function. This enables privilege escalation where lower-privileged users can inject content into posts and pages owned by other users or administrators, potentially defacing sites or injecting malicious content.
Open redirect in the WPEverest User Registration & Membership WordPress plugin (versions ≤5.1.4) enables attackers to abuse the logout flow as a phishing vector by supplying an arbitrary external URL via the `redirect_to_on_logout` GET parameter. The plugin passes this parameter directly to WordPress's unrestricted `wp_redirect()` instead of the domain-enforcing `wp_safe_redirect()`, and the `esc_url_raw()` sanitization applied only strips malformed URL syntax - it imposes no domain allowlist. A publicly available POC demonstrates the redirect behavior; however, EPSS is very low (0.03%, 7th percentile) and CISA SSVC rates exploitation as 'none' with non-automatable impact, indicating no observed mass exploitation at time of analysis.
SQL Injection in User Registration & Membership plugin for WordPress (versions up to 5.1.2) allows authenticated Subscriber-level attackers to extract sensitive database information via unsanitized 'membership_ids[]' parameter. The vulnerability stems from insufficient escaping and lack of prepared statements in SQL query construction, enabling attackers to append arbitrary SQL commands to existing queries. No public exploit code or active exploitation has been identified at the time of analysis.
The User Registration & Membership plugin for WordPress contains an insufficient capability check vulnerability in its Content Access Rules REST API endpoints, allowing authenticated contributors and above to bypass intended administrative restrictions. Versions 5.0.1 through 5.1.4 are affected, enabling attackers to list, create, modify, toggle, duplicate, and delete site-wide content restriction rules, potentially exposing restricted content or denying legitimate user access. The vulnerability has a CVSS score of 5.4 with low attack complexity and low privilege requirements, making it readily exploitable by any authenticated user with contributor-level access or higher.
Arbitrary shortcode execution in the User Registration & Membership WordPress plugin through 5.2.8 lets unauthenticated attackers place registered shortcodes into the HTTP Referer header so they are executed when a restricted page renders a Content Restriction message containing the {{referrer_url}} smart tag. The vulnerable path is UR_Smart_Tags::process(), where sanitize_text_field() leaves shortcode delimiters intact before the message is passed to apply_shortcodes()/do_shortcode(); impact is bounded to shortcodes registered on the target site. Exploitation requires the non-default Content Restriction configuration described above; no public exploit was identified at time of analysis, no CISA KEV confirmation was provided, and no EPSS score was supplied.
Stored cross-site scripting in the User Registration & Membership WordPress plugin (all versions up to and including 5.2.8) lets unauthenticated remote attackers plant arbitrary JavaScript by submitting a crafted Checkbox Field value through the plugin's public registration form. Because the nopriv AJAX action user_registration_user_form_submit reaches ur_process_registration() without any nonce validation, no account or valid token is required - the payload is persisted and later executes in the browser of anyone who views the injected page, most consequentially an administrator reviewing registrations. There is no public exploit code or CISA KEV entry at time of analysis, and the assessed impact is bounded to browser-context confidentiality and integrity (CVSS 7.2, scope changed) rather than server compromise, making this above-average priority but not emergency-tier.
Cross-site request forgery in the WordPress plugin User Registration & Membership through 5.2.8 lets unauthenticated attackers trick a logged-in administrator into approving pending registrations or denying arbitrary user accounts, potentially locking targeted users out of the site. Exploitation requires the administrator to click a crafted link or visit a malicious page (UI:R) and depends on an empty new_role parameter that bypasses the plugin's nonce check and WordPress core's bulk-user nonce validation. Impact is limited to unauthorized registration-status changes (low integrity, no confidentiality or availability impact); no public exploit identified at time of analysis.
Authenticated attackers holding only subscriber-level access can execute arbitrary WordPress shortcodes on sites running the WPEverest User Registration & Membership plugin in all versions up to and including 5.2.8, because an action passes an unvalidated value straight into do_shortcode without checking it first. The flaw is rated CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and there is no public exploit identified at time of analysis - it is not confirmed actively exploited (CISA KEV). Impact is bounded, but the practical risk is elevated on the many sites that leave open user registration enabled, since an attacker can simply self-provision the required subscriber account and then trigger the vulnerable shortcode path; sites that disable open registration meaningfully reduce exposure.
Payment bypass in WPEverest's User Registration & Membership WordPress plugin (versions up to and including 5.2.0) allows unauthenticated remote attackers to activate paid memberships without completing payment. The vulnerability stems from missing authorization checks in the confirm_payment() function (CWE-862), which fails to validate that a legitimate payment transaction occurred before granting membership access. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack is low-complexity and requires no authentication, making it trivially reachable by any internet-connected adversary.
Insecure Direct Object Reference in WPEverest's User Registration & Membership WordPress plugin (all versions through 5.1.5) allows deletion of arbitrary media attachments by exploiting missing ownership validation on user-controlled attachment IDs. Authenticated users at subscriber level or above can permanently destroy any media file uploaded by any other user, including administrators, by submitting a crafted attachment ID to the plugin's frontend handler. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV; however, the low barrier to exploitation - any registered site user qualifies - elevates practical risk on membership-driven WordPress sites.
The User Registration & Membership plugin for WordPress versions up to 5.1.4 allows authenticated attackers with Contributor-level access to append shortcode content to arbitrary pages without authorization due to a missing capability check in the embed_form_action() AJAX function. This enables privilege escalation where lower-privileged users can inject content into posts and pages owned by other users or administrators, potentially defacing sites or injecting malicious content.
Open redirect in the WPEverest User Registration & Membership WordPress plugin (versions ≤5.1.4) enables attackers to abuse the logout flow as a phishing vector by supplying an arbitrary external URL via the `redirect_to_on_logout` GET parameter. The plugin passes this parameter directly to WordPress's unrestricted `wp_redirect()` instead of the domain-enforcing `wp_safe_redirect()`, and the `esc_url_raw()` sanitization applied only strips malformed URL syntax - it imposes no domain allowlist. A publicly available POC demonstrates the redirect behavior; however, EPSS is very low (0.03%, 7th percentile) and CISA SSVC rates exploitation as 'none' with non-automatable impact, indicating no observed mass exploitation at time of analysis.
SQL Injection in User Registration & Membership plugin for WordPress (versions up to 5.1.2) allows authenticated Subscriber-level attackers to extract sensitive database information via unsanitized 'membership_ids[]' parameter. The vulnerability stems from insufficient escaping and lack of prepared statements in SQL query construction, enabling attackers to append arbitrary SQL commands to existing queries. No public exploit code or active exploitation has been identified at the time of analysis.
The User Registration & Membership plugin for WordPress contains an insufficient capability check vulnerability in its Content Access Rules REST API endpoints, allowing authenticated contributors and above to bypass intended administrative restrictions. Versions 5.0.1 through 5.1.4 are affected, enabling attackers to list, create, modify, toggle, duplicate, and delete site-wide content restriction rules, potentially exposing restricted content or denying legitimate user access. The vulnerability has a CVSS score of 5.4 with low attack complexity and low privilege requirements, making it readily exploitable by any authenticated user with contributor-level access or higher.