Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-17
User Registration Membership - Authentication Bypass (CVE-2026-1779)
The User Registration & Membership plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.2. This is due to incorrect authentication in the 'register_member' function. This makes it possible for unauthenticated attackers to log in a newly registered user on the site who has the 'urm_user_just_created' user meta set.
PLUGIN
User Registration Membership
CVE-2026-1779
Risk Score
Threat Entry
Updated 2026-06-17
User Registration Membership - SQL Injection (CVE-2025-9085)
The User Registration & Membership plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in version 4.3.0. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
User Registration Membership
CVE-2025-9085
Risk Score
Threat Entry
Updated 2026-06-17
User Registration Membership - Security Vulnerability (CVE-2025-3281)
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.1 via the create_stripe_subscription() function, due to missing validation on the 'member_id' user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary user accounts that have registered through the plugin.
PLUGIN
User Registration Membership
CVE-2025-3281
Risk Score
Threat Entry
Updated 2026-06-17
User Registration Membership - Cross-Site Scripting (XSS) (CVE-2025-39400)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration user-registration allows Reflected XSS.This issue affects User Registration: from n/a through < 4.2.0.
PLUGIN
User Registration Membership
CVE-2025-39400
Risk Score
Threat Entry
Updated 2026-06-17
User Registration & Membership - Security Vulnerability (CVE-2025-2594)
The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowing attackers to authenticate as any user, including administrators, by simply using the target account's user ID.
PLUGIN
User Registration & Membership
CVE-2025-2594
Risk Score
Threat Entry
Updated 2026-06-17
User Registration Membership - Cross-Site Request Forgery (CSRF) (CVE-2025-3284)
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.1.3. This is due to missing or incorrect nonce validation on the user_registration_pro_delete_account() function. This makes it possible for unauthenticated attackers to force delete users, including administrators, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
User Registration Membership
CVE-2025-3284
Risk Score
Threat Entry
Updated 2026-06-17
User Registration & Membership - Privilege Escalation (CVE-2025-2563)
The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated users to gain admin privileges
PLUGIN
User Registration & Membership
CVE-2025-2563
Risk Score
Threat Entry
Updated 2026-06-17
User Registration & Membership - Security Vulnerability (CVE-2025-3282)
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_registration_membership_register_member() due to missing validation on the 'membership_id' user controlled key. This makes it possible for unauthenticated attackers to update any user's membership to any other active or non-active membership type.
PLUGIN
User Registration & Membership
CVE-2025-3282
Risk Score
Threat Entry
Updated 2026-06-17
User Registration & Membership - Security Vulnerability (CVE-2025-3292)
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_registration_update_profile_details() due to missing validation on the 'user_id' user controlled key. This makes it possible for unauthenticated attackers to update other user's passwords, if they have access to the user ID and email.
PLUGIN
User Registration & Membership
CVE-2025-3292
Risk Score
Threat Entry
Updated 2026-06-17
User Registration Membership - Cross-Site Scripting (XSS) (CVE-2025-30899)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through
PLUGIN
User Registration Membership
CVE-2025-30899
Risk Score
Threat Entry
Updated 2026-06-17
User Registration & Membership - Cross-Site Scripting (XSS) (CVE-2025-1511)
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 4.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
User Registration & Membership
CVE-2025-1511
Risk Score
Threat Entry
Updated 2026-06-17
User Registration Membership - PHP Object Injection (CVE-2023-27459)
Deserialization of Untrusted Data vulnerability in WPEverest User Registration.This issue affects User Registration: from n/a through 2.3.2.1.
PLUGIN
User Registration Membership
CVE-2023-27459
Risk Score
Threat Entry
Updated 2026-06-17
User Registration Membership - Cross-Site Scripting (XSS) (CVE-2024-1720)
The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Display Name' parameter in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability requires social engineering to successfully exploit, and the impact would be very limited due to the attacker requiring a user…
PLUGIN
User Registration Membership
CVE-2024-1720
Risk Score