CVE-2026-105881

6.5Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.5Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required
Impact: Limited impact
Weakness: CWE-79

Impact

Authenticated attackers with low privileges can execute arbitrary JavaScript in the context of other users or administrators via stored XSS. Exploitation requires an authenticated user account and victim interaction to view the compromised page.

Root cause

The plugin fails to sanitize and neutralize user-supplied input before rendering it on web pages, leading to stored cross-site scripting.

Affected systems

ThemeGrill User Registration plugin through 5.2.8

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Fix & remediation

Upgrade User Registration to a version later than 5.2.8 as soon as available, or deactivate the plugin until patched.

shell

$ wp plugin update user-registration

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through 5.2.8.

References

https://patchstack.com/database/wordpress/plugin/user-registration/vulnerability/wordpress-user-registration-plugin-5-2-8-cross-site-scripting-xss-vulnerability?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-105881