CVE-2026-15222: User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name
The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.2.8. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to WordPress with at least Subscriber-level access. Unauthenticated visitors are not described as able to exploit it.
What access or capability does exploitation provide?
A qualifying authenticated user can cause arbitrary shortcodes to be executed through the affected handling of display_name. The provided CVSS vector indicates low confidentiality and integrity impact, with no availability impact.
Which plugin versions are affected?
All versions of WPEverest User Registration & Membership through version 5.2.8, including 5.2.8, are affected.