WordPress plugin · user-registration
Is User Registration & Membership safe?
Safe on 5.3.1 or newer.
The current version, 5.3.1, is past every affected range on record (66 of 69 records list one; 3 don’t, so check those below). Keep it updated and you’re clear of them.
- Flaws on record
- 69
- High or critical
- 25
- Exploited
- none
- Current version
- 5.3.1
- Last updated
- Oct 17, 2026
- Active installs
- 50,000+
Every recorded flaw
- Oct 17, 2026The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin CVE-2026-96660 · affects up to 5.2.8 · reported by WordfenceHigh 7.2
- Oct 17, 2026The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin CVE-2026-92978 · affects up to 5.2.8 · reported by WordfenceMedium 4.3
- Oct 17, 2026User Registration & Membership: Arbitrary Shortcode ExecutionCVE-2026-92798 · affects up to 5.2.8 · reported by WordfenceHigh 8.1
- Oct 16, 2026The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder pluCVE-2026-15222 · affects up to 5.2.8 · reported by WordfenceMedium 5.4
- Oct 15, 2026User Registration: Missing AuthorizationCVE-2026-109692 · affects up to 5.2.8 · reported by PatchstackHigh 7.1
- Oct 15, 2026User Registration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105882 · affects up to 5.2.8 · reported by PatchstackMedium 6.5
- Oct 13, 2026User Registration: Missing AuthorizationCVE-2026-109699 · affects up to 5.2.8 · reported by PatchstackMedium 5.4
- Oct 13, 2026User Registration: Missing AuthorizationCVE-2026-106598 · affects up to 5.2.8 · reported by PatchstackMedium 5.3
- Oct 13, 2026User Registration: Missing AuthorizationCVE-2026-106597 · affects up to 5.2.8 · reported by PatchstackMedium 5.3
- Oct 13, 2026User Registration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105881 · affects up to 5.2.8 · reported by PatchstackMedium 6.5
- Oct 13, 2026User Registration: Cross-Site Request Forgery (CSRF)CVE-2026-103076 · affects up to 5.2.8 · reported by PatchstackMedium 5.4
- Oct 9, 2026User Registration: Missing AuthorizationCVE-2026-96334 · affects up to 5.2.7 · reported by PatchstackMedium 5.6
- Sep 17, 2026Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions.CVE-2026-74017 · affects up to 5.2.7 · reported by PatchstackMedium 5.3
- Sep 13, 2026User Registration & Membership: Does not verify that the visitor requesting its membership confirmation page owns the account named in the requestCVE-2026-86407 · fixed in 5.2.8 · reported by WPScanLow 3.7
- Sep 13, 2026User Registration & Membership: Does not check the capability of the user making a membership purchaseCVE-2026-86406 · fixed in 5.2.8 · reported by WPScanHigh 7.5
- Sep 13, 2026User Registration & Membership: Does not validate the destination of a post-login redirect before redirectingCVE-2026-80072 · fixed in 5.2.8 · reported by WPScanMedium 4.7
- Sep 13, 2026User Registration & Membership: Does not properly restrict who may author a membership plan or validate the plan a user attaches to their own accountCVE-2026-80071 · fixed in 5.2.8 · reported by WPScanHigh 7.2
- Aug 28, 2026User Registration & Membership: Does not perform a capability checkCVE-2026-79996 · fixed in 5.2.6 · reported by WPScanHigh 7.2
- Aug 28, 2026User Registration & Membership: Does not verify that the account whose pending email change is being cancelled belongs to the user making the requestCVE-2026-79995 · fixed in 5.2.5 · reported by WPScanMedium 4.3
- Aug 18, 2026Subscriber Broken Authentication in User Registration <= 5.2.6 versions.CVE-2026-73995 · affects up to 5.2.6 · reported by PatchstackMedium 5.4
- Aug 13, 2026Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions.CVE-2026-73403 · affects up to 5.2.6 · reported by PatchstackMedium 5.3
- Aug 5, 2026User Registration & Membership: Does not enforce the site's registration-disabled settingCVE-2026-16736 · fixed in 5.2.6 · reported by WPScanHigh 7.5
- Jul 17, 2026User Registration & Membership: Does not perform a capability check for unauthenticated callers on one of its membership payment actions and acts on a caller-supplied user identifierCVE-2026-11966 · fixed in 5.2.3 · reported by WPScanMedium 5.3
- Jul 17, 2026User Registration & Membership: Does not validate that the membership tier submitted during public registration is one of the tiers allowed by the registration form before assigning that tier's associated user roleCVE-2026-11961 · fixed in 5.2.3 · reported by WPScanHigh 8.1
- Jul 13, 2026User Registration & Membership: Does not verify the authenticity of incoming payment-provider webhook notifications before acting on themCVE-2026-11964 · fixed in 5.2.2 · reported by WPScanCritical 9.1
- Jul 13, 2026User Registration & Membership: Does not perform an authorization check on a membership-upgrade action and derives the user to modify from a caller-supplied identifier instead of the current userCVE-2026-11963 · fixed in 5.2.2 · reported by WPScanHigh 8.1
- Jul 2, 2026User Registration & Membership: Does not enforce payment completion before activating a paid membership subscriptionCVE-2026-11965 · fixed in 5.2.0 · reported by WPScanMedium 6.5
- Jun 26, 2026Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions.CVE-2026-52701 · reported by PatchstackMedium 6.5
- Jun 26, 2026The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin CVE-2026-1869 · affects up to 5.2.0 · reported by WordfenceMedium 6.5
- Jun 15, 2026Unauthenticated Broken Access Control in User Registration <= 5.1.2 versions.CVE-2026-25425 · affects up to 5.1.2 · reported by PatchstackHigh 7.5
- May 28, 2026The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin CVE-2026-7651 · affects up to 5.1.5 · reported by WordfenceMedium 5.3
- May 14, 2026User Registration & Membership: Missing AuthorizationCVE-2026-6145 · affects up to 5.1.5 · reported by WordfenceMedium 5.3
- May 5, 2026User Registration & Membership: Unauthorized modification of dataCVE-2026-3601 · affects up to 5.1.4 · reported by WordfenceMedium 4.3
- Apr 29, 2026User Registration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42652 · affects up to 5.1.5 · reported by PatchstackHigh 7.1
- Apr 13, 2026User Registration & Membership: Open RedirectCVE-2026-6203 · affects up to 5.1.4 · reported by WordfenceMedium 6.1
- Apr 8, 2026The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin CVE-2026-1865 · affects up to 5.1.2 · reported by WordfenceMedium 6.5
- Mar 25, 2026User Registration: Incorrect Privilege AssignmentCVE-2026-32488 · affects up to 4.4.9 · reported by PatchstackHigh 8.1
- Mar 23, 2026User Registration & Membership: Unauthorized modification of dataCVE-2026-4056 · affects up to 5.1.4 · reported by WordfenceMedium 5.4
- Mar 3, 2026The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPCVE-2026-1492 · affects up to 5.1.2 · reported by Wordfence29% oddsCritical 9.8
- Feb 25, 2026User Registration & Membership – Custom Registration Form, Login Form, and User Profile: Insecure Direct Object ReferenceCVE-2026-2356 · affects up to 5.1.2 · reported by WordfenceMedium 5.3
- Feb 25, 2026User Registration & Membership: Authentication bypassCVE-2026-1779 · affects up to 5.1.2 · reported by WordfenceHigh 8.1
- Jan 22, 2026User Registration: Missing AuthorizationCVE-2026-24353 · affects up to 4.4.9 · reported by PatchstackMedium 4.3
- Jan 22, 2026User Registration: Missing AuthorizationCVE-2025-67956 · affects up to 4.4.6 · reported by PatchstackHigh 8.2
- Jan 10, 2026The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPCVE-2025-14976 · affects up to 4.4.8 · reported by WordfenceMedium 5.4
- Dec 15, 2025The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin for WordPress isCVE-2025-13367 · affects up to 4.4.6 · reported by WordfenceMedium 6.4
- Sep 5, 2025User Registration & Membership: SQL InjectionCVE-2025-9085 · reported by WordfenceMedium 4.9
- Jul 21, 2025User Registration: Stored Cross-Site ScriptingCVE-2025-6831 · affects up to 4.2.4 · reported by WordfenceMedium 6.4
- May 6, 2025User Registration & Membership – Custom Registration Form, Login Form, and User Profile: Insecure Direct Object ReferenceCVE-2025-3281 · affects up to 4.2.1 · reported by WordfenceMedium 5.3
- Apr 24, 2025User Registration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39400 · reported by PatchstackHigh 7.1
- Apr 22, 2025User Registration & Membership: Does not properly validate data in an AJAX actionCVE-2025-2594 · fixed in 4.1.3 · reported by WPScan9.5% oddsHigh 8.1
- Apr 18, 2025User Registration & Membership – Custom Registration Form, Login Form, and User Profile: Cross-Site Request ForgeryCVE-2025-3284 · affects up to 5.1.3 · reported by WordfenceMedium 4.3
- Apr 14, 2025User Registration & Membership: Does not prevent users to set their account roleCVE-2025-2563 · fixed in 4.1.2 · reported by WPScan49% oddsHigh 8.1
- Apr 12, 2025User Registration & Membership – Custom Registration Form, Login Form, and User Profile: Insecure Direct Object ReferenceCVE-2025-3292 · affects up to 4.1.3 · reported by WordfenceMedium 4.3
- Apr 12, 2025User Registration & Membership – Custom Registration Form, Login Form, and User Profile: Insecure Direct Object ReferenceCVE-2025-3282 · affects up to 4.1.3 · reported by WordfenceMedium 5.3
- Mar 27, 2025User Registration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30899 · affects up to 4.0.3 · reported by PatchstackMedium 5.9
- Feb 28, 2025User Registration & Membership – Custom Registration Form, Login Form, and User Profile: Reflected Cross-Site ScriptingCVE-2025-1511 · affects up to 4.0.4 · reported by WordfenceMedium 6.1
- Dec 9, 2024User Registration: Missing AuthorizationCVE-2023-29429 · affects up to 2.3.2.1 · reported by PatchstackMedium 5.3
- Jun 1, 2024User Registration – Custom Registration Form, Login Form, and User Profile: Unauthorized modification of dataCVE-2024-4958 · affects up to 3.2.0.1 · reported by WordfenceHigh 7.1
- May 2, 2024User Registration – Custom Registration Form, Login Form, and User Profile: Unauthorized loss of dataCVE-2024-3295 · affects up to 3.1.5 · reported by WordfenceMedium 6.5
- May 2, 2024User Registration – Custom Registration Form, Login Form, and User Profile: Privilege escalationCVE-2024-2417 · affects up to 3.1.5 · reported by WordfenceHigh 8.8
- Mar 26, 2024User Registration: Deserialization of Untrusted DataCVE-2023-27459 · affects up to 2.3.2.1 · reported by PatchstackHigh 7.4
- Mar 11, 2024User Registration: Does not prevent users with at least the contributor role from rendering sensitive shortcodesCVE-2024-1290 · fixed in 2.12 · reported by WPScanMedium 6.5
- Mar 7, 2024User Registration – Custom Registration Form, Login Form, and User Profile: Stored Cross-Site ScriptingCVE-2024-1720 · affects up to 3.1.4 · reported by WordfenceMedium 4.7
- Nov 6, 2023User Registration: Does not sanitize and escape some of its settingsCVE-2023-5228 · fixed in 3.0.4.2 · reported by WPScanMedium 4.8
- Jul 12, 2023User Registration: PHP Object InjectionCVE-2023-3343 · affects up to 3.0.1 · reported by Wordfence1.1% oddsHigh 8.8
- Jul 12, 2023User Registration: Arbitrary file uploadsCVE-2023-3342 · affects up to 3.0.2 · reported by Wordfence1.7% oddsCritical 9.9
- Apr 6, 2023Auth.CVE-2023-23987 · fixed in 2.3.1 · reported by PatchstackMedium 5.9
- Dec 12, 2022User Registration: Does not properly restrict the files to be uploaded via an AJAX action available to both unauthenticated and authenticated usersCVE-2022-3912 · fixed in 2.2.4.1 · reported by WPScanHigh 7.5
- Oct 4, 2021User Registration: Does not properly sanitise the user_registration_profile_pic_url valueCVE-2021-24654 · fixed in 2.0.2 · reported by WPScanMedium 5.4
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Get in touch
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
Not ready to talk yet? Run the free website check and see what Google sees.