CVE-2026-96660: User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Checkbox Field Value in all versions up to, and including, 5.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nopriv AJAX action userregistrationuserformsubmit reaches urprocessregistration() without nonce validation, meaning any unauthenticated request can reach the vulnerable code path.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can reach the vulnerable registration submission path. No account, nonce, or user interaction is required to submit the malicious checkbox field value.
Which installations are affected?
All versions of the WPEverest User Registration & Membership plugin up to and including 5.2.8 are affected. The vulnerable path is the unauthenticated AJAX action user_registration_user_form_submit.
What is required for the injected script to run?
The attacker must inject a script through a checkbox field value, and a user must later access a page where that injected value is rendered. The script then executes in that user's browser.
What can an attacker do through successful exploitation?
The issue allows stored cross-site scripting, enabling arbitrary web scripts to execute for users who view an injected page. The provided severity vector indicates potential impact to confidentiality and integrity, but no availability impact.