Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · wp-registration
Simple User Registration
6 known vulnerabilities on record. Add your version above to see which ones affect you.
Jan 28, 2026Simple User Registration: Privilege escalationCVE-2026-0844 · affects up to 6.7 · reported by WordfenceHigh 8.8
The Simple User Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 6.7 due to insufficient restriction on the 'profile_save_field' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_capabilities' parameter during a profile update.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 21, 2025Simple User Registration: Stored Cross-Site ScriptingCVE-2025-12160 · affects up to 6.6 · reported by WordfenceHigh 7.2
The Simple User Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpr_admin_msg' parameter in all versions up to, and including, 6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Oct 22, 2025Simple User Registration: Incorrect Privilege AssignmentCVE-2025-53428 · affects up to 6.8 · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in N-Media Simple User Registration wp-registration allows Privilege Escalation.This issue affects Simple User Registration: from n/a through <= 6.8.
Jun 25, 2025Simple User Registration: Privilege EscalationCVE-2025-4334 · affects up to 6.3 · reported by WordfenceCritical 9.8
The Simple User Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3. This is due to insufficient restrictions on user meta values that can be supplied during registration. This makes it possible for unauthenticated attackers to register as an administrator.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 6, 2024Simple User Registration: Missing AuthorizationCVE-2024-53810 · affects up to 5.5 · reported by PatchstackCritical 9.1
Missing Authorization vulnerability in N-Media Simple User Registration wp-registration allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Simple User Registration: from n/a through <= 5.5.
Oct 20, 2024Simple User Registration: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-49604 · affects up to 6.7 · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in N-Media Simple User Registration wp-registration allows Authentication Bypass.This issue affects Simple User Registration: from n/a through <= 6.7.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.