Plugin icon

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

user-registration

Vulnerabilities:

31

Last Updated:

March 18, 2026

Active Installs:

60000

Published
Title
Fixed in
CVSS
Published
2026-03-23
Title
User Registration & Membership < 5.1.5 - Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation
Fixed in
Fixed in 5.1.5
CVSS
3.8 (low)
Published
2026-03-02
Title
User Registration & Membership < 5.1.3 - Unauthenticated Privilege Escalation via Membership Registration
Fixed in
Fixed in 5.1.3
CVSS
9.8 (critical)
Published
2026-02-25
Title
User Registration & Membership < 5.1.3 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion
Fixed in
Fixed in 5.1.3
CVSS
5.3 (medium)
Published
2026-02-25
Title
User Registration & Membership < 5.1.3 - Authentication Bypass
Fixed in
Fixed in 5.1.3
CVSS
8.1 (high)
Published
2026-01-21
Title
User Registration < 4.4.7 - Missing Authorization
Fixed in
Fixed in 4.4.7
CVSS
5.3 (medium)
Published
2026-01-09
Title
User Registration & Membership < 4.4.9 - Cross-Site Request Forgery to Arbitrary Post Deletion
Fixed in
Fixed in 4.4.9
CVSS
5.4 (medium)
Published
2026-01-08
Title
User Registration < 5.0 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
Fixed in
Fixed in 5.0
CVSS
5.4 (medium)
Published
2025-12-15
Title
User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin < 4.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Fixed in
Fixed in 4.4.7
CVSS
6.4 (medium)
Published
2025-09-05
Title
User Registration & Membership < 4.4.0 - Authenticated (Admin+) SQL Injection
Fixed in
Fixed in 4.4.0
CVSS
4.9 (medium)
Published
2025-07-21
Title
User Registration < 4.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via urcr_restrict Shortcode
Fixed in
Fixed in 4.3.0
CVSS
6.4 (medium)
Published
2025-05-05
Title
User Registration & Membership – Custom Registration Form, Login Form, and User Profile < 4.2.2 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion
Fixed in
Fixed in 4.2.2
CVSS
5.3 (medium)
Published
2025-04-22
Title
User Registration < 4.2.0 - Reflected Cross-Site Scripting
Fixed in
Fixed in 4.2.0
CVSS
6.1 (medium)
Published
2025-04-11
Title
User Registration & Membership – Custom Registration Form, Login Form, and User Profile < 4.1.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Password Update
Fixed in
Fixed in 4.1.4
CVSS
4.3 (medium)
Published
2025-04-11
Title
User Registration & Membership – Custom Registration Form, Login Form, and User Profile < 4.1.4 - Insecure Direct Object Reference to Unauthenticated Membership Modification
Fixed in
Fixed in 4.1.4
CVSS
5.3 (medium)
Published
2025-04-01
Title
User Registration & Membership (Free < 4.1.3, Pro < 5.1.3) - Authentication Bypass
Fixed in
Fixed in 4.1.3
CVSS
8.1 (high)
Published
2025-03-27
Title
User Registration < 4.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Fixed in
Fixed in 4.0.4
CVSS
4.4 (medium)
Published
2025-03-24
Title
User Registration & Membership (Free < 4.1.2, Pro < 5.1.2) - Unauthenticated Privilege Escalation
Fixed in
Fixed in 4.1.2
CVSS
8.1 (high)
Published
2025-02-27
Title
User Registration & Membership – Custom Registration Form, Login Form, and User Profile < 4.1.0 - Reflected Cross-Site Scripting
Fixed in
Fixed in 4.1.0
CVSS
6.1 (medium)
Published
2024-05-31
Title
User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin < 3.2.1 - Missing Authorization to Privilege Escalation
Fixed in
Fixed in 3.2.1
CVSS
7.1 (high)
Published
2024-04-19
Title
User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin < 3.2.0 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
Fixed in
Fixed in 3.2.0
CVSS
8.8 (high)
Published
2024-04-15
Title
User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin < 3.2.0 - Missing Authorization to Unauthenticated Media Deletion
Fixed in
Fixed in 3.2.0
CVSS
6.5 (medium)
Published
2024-03-06
Title
User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin < 3.1.5 - Unauthenticated Stored Self-Based Cross-Site Scripting
Fixed in
Fixed in 3.1.5
CVSS
4.7 (medium)
Published
2023-10-16
Title
User Registration < 3.0.4.2 - Admin+ Stored XSS
Fixed in
Fixed in 3.0.4.2
CVSS
3.5 (low)
Published
2023-07-14
Title
User Registration < 3.0.2.1 - Subscriber+ Arbitrary File Upload Leading to RCE
Fixed in
Fixed in 3.0.2.1
CVSS
9.9 (critical)
Published
2023-07-12
Title
User Registration < 3.0.2.1 - Subscriber+ Arbitrary File Upload
Fixed in
Fixed in 3.0.2.1
CVSS
9.9 (critical)
Published
2023-06-29
Title
User Registration < 3.0.2 - Subscriber+ PHP Object Injection
Fixed in
Fixed in 3.0.2
CVSS
8.8 (high)
Published
2023-03-21
Title
User Registration < 2.3.3 - Subscriber+ PHP Object Injection
Fixed in
Fixed in 2.3.3
CVSS
7.5 (high)
Published
2023-01-20
Title
User Registration < 2.3.1 - Admin+ Stored XSS
Fixed in
Fixed in 2.3.1
CVSS
3.5 (low)
Published
2022-11-21
Title
User Registration < 2.2.4.1 - Subscriber+ Arbitrary File Upload
Fixed in
Fixed in 2.2.4.1
CVSS
9.9 (critical)
Published
2021-09-06
Title
User Registration < 2.0.2 - Low Privilege Stored Cross-Site Scripting
Fixed in
Fixed in 2.0.2
CVSS
6.5 (medium)
Published
2019-01-09
Title
User Registration <= 1.5.5 - Authenticated Cross-Site Scripting (XSS)
Fixed in
Fixed in 1.5.6
CVSS
n/a