Software intelligence

User Registration vulnerabilities

48 tracked advisories · slug user-registration

Important: User Registration appearing in this catalog does not mean your website is affected. Exposure depends on your installed version. How SiteRespond intelligence works

Tracked advisories

Latest advisory

14 August 2026

CISA KEV matches

In this WordPress feed

WordPress slug

user-registration

Plugin

What this means for User Registration

This catalog lists 48 known advisories affecting User Registration. The most recent was published on 14 August 2026. If you use this software, compare your installed version against the affected ranges on each advisory and update to a fixed release outside those ranges. SiteRespond Defence checks your actual installed version when the plugin is connected — listing here does not by itself mean your site is vulnerable.

Latest issues

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.6 - Missing Authorization
This advisory describes a other issue in the affected software. Review the source advisory and your installed version to assess exposure.
Published 14 August 2026
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.6 - Missing Authorization
This advisory describes a other issue in the affected software. Review the source advisory and your installed version to assess exposure.
Published 13 August 2026
User Registration & Membership <= 5.2.5 - Missing Authorization to Unauthenticated Account Creation While Registration Disabled
This advisory describes a other issue in the affected software. Review the source advisory and your installed version to assess exposure.
Published 27 July 2026

Vulnerability types

Cross-site scripting10
Privilege escalation5
Remote code execution3
SQL injection2
Authentication bypass2
CSRF1

Authentication (inferred from titles)

Unauthenticated16
Authenticated17
Unspecified15

Advisory history

Known User Registration advisories published by month.

Oct 25

Nov 25

Dec 25

Jan 26

Feb 26

Mar 26

Apr 26

May 26

Jun 26

Jul 26

Aug 26

Sept 26

All advisories

User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Password Update
CVE-2025-3292 · Published 11 April 2025
Affected versions: ≤ 4.1.3
User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Unauthenticated Membership Modification
CVE-2025-3282 · Published 11 April 2025
Affected versions: ≤ 4.1.3
User Registration & Membership <= 4.1.2 - Authentication Bypass
CVE-2025-2594 · Published 1 April 2025
Affected versions: ≤ 4.1.2
User Registration <= 4.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
CVE-2025-30899 · Published 27 March 2025
Affected versions: ≤ 4.0.3
User Registration & Membership <= 4.1.1 - Unauthenticated Privilege Escalation
CVE-2025-2563 · Published 24 March 2025
Affected versions: ≤ 4.1.1
User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.0.4 - Reflected Cross-Site Scripting
CVE-2025-1511 · Published 27 February 2025
Affected versions: ≤ 4.0.4
User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.2.0.1 - Missing Authorization to Privilege Escalation
CVE-2024-4958 · Published 31 May 2024
Affected versions: ≤ 3.2.0.1
User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
CVE-2024-2417 · Published 19 April 2024
Affected versions: ≤ 3.1.5
User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Unauthenticated Media Deletion
CVE-2024-3295 · Published 15 April 2024
Affected versions: ≤ 3.1.5
User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.4 - Unauthenticated Stored Self-Based Cross-Site Scripting
CVE-2024-1720 · Published 6 March 2024
Affected versions: ≤ 3.1.4
User Registration – Custom Registration Form, Login Form And User Profile For WordPress <= 3.0.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting
CVE-2023-5228 · Published 16 October 2023
Affected versions: ≤ 3.0.4.1
User Registration <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Upload
CVE-2023-3342 · Published 4 July 2023
Affected versions: ≤ 3.0.2
User Registration <= 3.0.1 - Authenticated (Subscriber+) PHP Object Injection
CVE-2023-3343 · Published 29 June 2023
Affected versions: ≤ 3.0.1
User Registration <= 2.3.2.1 - Missing Authorization via send_test_email
CVE-2023-29429 · Published 6 April 2023
Affected versions: ≤ 2.3.2.1
User Registration <= 2.3.2.1 - PHP Object Injection
CVE-2023-27459 · Published 21 March 2023
Affected versions: ≤ 2.3.2.1

31–45 of 48

3 / 4

Check whether your installed version is affected

SiteRespond Defence matches your installed User Registration version against this catalog when the Defence plugin is connected to your WordPress site.

Start SiteRespond Defence for WordPress — £29.99/monthScan your website