User Registration vulnerabilities

6 known vulnerabilities in User Registration from Wpeverest. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  User Registration: Improper Neutralization of Input During Web Page Generation

  CVE-2026-42652Apr 29, 2026Wpeverest

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration user-registration allows Reflected XSS.This issue affects User Registration: from n/a through <= 5.1.5.

• 8.1 High severity

  User Registration: Incorrect Privilege Assignment

  CVE-2026-32488Mar 25, 2026Wpeverest

  Incorrect Privilege Assignment vulnerability in wpeverest User Registration user-registration allows Privilege Escalation.This issue affects User Registration: from n/a through <= 4.4.9.

• 8.2 High severity

  User Registration: Missing Authorization

  CVE-2025-67956Jan 22, 2026Wpeverest

  Missing Authorization vulnerability in wpeverest User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through <= 4.4.6.

• 8.8 High severity

  User Registration & Membership – Free & Paid…: Missing Authorization

  CVE-2024-2417May 2, 2024Wpeverest

  The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the form_save_action() function in all versions up to, and including

• 8.8 High severity

  User Registration & Membership – Free & Paid…: Deserialization of Untrusted Data

  CVE-2023-3343Jul 13, 2023WpeverestEPSS 1.13%

  The User Registration plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.0.1 via deserialization of untrusted input from the 'profile-pic-url' parameter. This allows authenticated attackers, with subscriber-level per

• 9.9 Critical severity

  User Registration & Membership – Free & Paid…: Unrestricted Upload of File with Dangerous Type

  CVE-2023-3342Jul 13, 2023WpeverestEPSS 1.69%

  The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and missing file type validation on the 'ur_upload_profile_pic' function in versions up to, and including, 3.0.2. This makes it possible for au