CVE-2025-13367
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin for WordPress (all versions up to and including 4.4.6) is vulnerable to Stored Cross-Site Scripting via multiple shortcode attributes due to insufficient input sanitization and output escaping. An authenticated attacker with contributor level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Risk Assessment
An attacker can execute arbitrary JavaScript in the victim's browser, potentially leading to session theft, redirects, or other actions in the context of an authenticated user.
Recommendation
Update the User Registration & Membership plugin to a version newer than 4.4.6. Consider restricting content publishing capabilities for low-privilege users.
Other vulnerabilities in User Registration & Membership
See all- CVE-2026-11964Critical
The User Registration & Membership WordPress plugin before version 5.2.2 does not verify the authenticity of incoming payment-provider webhook notifications before acting on them. This allows unauthenticated attackers to forge a payment-approved event and activate a paid membership subscription without completing a real payment.
- CVE-2026-80072Medium
The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting. This allows unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing.
- CVE-2026-11966Medium
The User Registration & Membership WordPress plugin before version 5.2.3 does not perform a capability check for unauthenticated callers on one of its membership payment actions and acts on a caller-supplied user identifier, allowing unauthenticated attackers to delete recently-registered, payment-pending user accounts.
- CVE-2026-11961High
The User Registration & Membership WordPress plugin before version 5.2.3 does not validate that the membership tier submitted during public registration is one of the tiers allowed by the registration form. This allows unauthenticated users to register into an arbitrary published membership tier and obtain its associated role, including administrator if such a tier exists.
- CVE-2026-11963High
The User Registration & Membership WordPress plugin before version 5.2.2 lacks authorization checks on a membership-upgrade action and derives the user to modify from a caller-supplied identifier instead of the current user. This allows any authenticated user, such as a subscriber, to change another user's WordPress role and membership tier.
- CVE-2026-11965Medium
The User Registration & Membership WordPress plugin before version 5.2.0 does not enforce payment completion before activating a paid membership subscription. This allows unauthenticated users (after self-registering an account through the open registration flow) to obtain an active subscription on any paid plan without paying and access the gated content.
- CVE-2026-1865Medium
The User Registration & Membership plugin for WordPress is vulnerable to SQL Injection via the 'membership_ids[]' parameter in all versions up to and including 5.1.2. Insufficient escaping and preparation on the SQL query allows authenticated attackers (Subscriber-level and above) to append additional SQL queries.
Original NVD description (English source)
The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcode attributes in all versions up to, and including, 4.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS