CVE-2026-25467: WordPress User Registration plugin <= 5.3.0 - Content Injection vulnerability

Q: Which deployments are affected?

The issue affects ThemeGrill User Registration versions through 5.3.0. The provided information does not identify any configuration prerequisites or exclusions.

Q: Can an unauthenticated attacker exploit this issue?

Yes. The vector is network-based and the metrics indicate no privileges or user interaction are required. The provided data does not specify the affected input or endpoint.

Q: What is the expected impact of successful exploitation?

Successful exploitation can result in content injection or basic cross-site scripting, with low confidentiality impact. No integrity or availability impact is indicated.

Published Oct 29, 2026

Updated

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ThemeGrill User Registration user-registration allows Code Injection.This issue affects User Registration: from n/a through 5.3.0.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress User Registration plugin to a version that resolves this vulnerability.
Fixed in 5.3.1

Frequently Asked Questions

Which deployments are affected?

The issue affects ThemeGrill User Registration versions through 5.3.0. The provided information does not identify any configuration prerequisites or exclusions.

Can an unauthenticated attacker exploit this issue?

Yes. The vector is network-based and the metrics indicate no privileges or user interaction are required. The provided data does not specify the affected input or endpoint.

What is the expected impact of successful exploitation?