CVE-2025-1511: User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.0.4 - Reflected Cross-Site Scripting
First published: Fri Feb 28 2025(Updated: )
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 4.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WordPress User Registration & Membership | <=4.0.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0e0bee7c-8dce-421c-af16-7e5152797e6c?source=cve
- https://plugins.trac.wordpress.org/browser/user-registration/tags/4.0.2/modules/membership/includes/Admin/Membership/ListTable.php#L246
- https://plugins.trac.wordpress.org/changeset/3246826/user-registration/tags/4.1.0/modules/membership/includes/Admin/Membership/ListTable.php
Frequently Asked Questions
What is the severity of CVE-2025-1511?
CVE-2025-1511 is classified as a high severity vulnerability due to its potential to allow reflected cross-site scripting attacks.
How do I fix CVE-2025-1511?
To fix CVE-2025-1511, update the User Registration & Membership plugin to version 4.1.0 or higher.
What version of the plugin is affected by CVE-2025-1511?
CVE-2025-1511 affects all versions of the User Registration & Membership plugin up to and including version 4.0.4.
What type of vulnerability is CVE-2025-1511?
CVE-2025-1511 is a reflected cross-site scripting vulnerability caused by insufficient input sanitization and output escaping.
Is CVE-2025-1511 specific to WordPress?
Yes, CVE-2025-1511 specifically affects the User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress.
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/event
- agent/severity
- agent/weakness
- agent/title
- agent/last-modified-date
- agent/references
- agent/author
- agent/source
- agent/type
- agent/description
- agent/first-publish-date
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- vendor/wordpress
- canonical/wordpress user registration & membership