CVE-2026-96660

7.2High

Published 17 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

7.2High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-79

Impact

Unauthenticated attackers can inject persistent malicious scripts that execute in other users' browsers. All they need is network access to submit a registration form via the exposed AJAX endpoint.

Root cause

The registration handler processes checkbox field values without nonce verification, input sanitization, or output escaping.

Affected systems

User Registration WordPress plugin versions up to and including 5.2.8

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Fix & remediation

Upgrade the User Registration plugin to a version newer than 5.2.8. If you cannot patch immediately, disable the plugin or block unauthenticated access to the user_registration_user_form_submit AJAX action.

shell

$ wp plugin update user-registration

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Checkbox Field Value in all versions up to, and including, 5.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nopriv AJAX action user_registration_user_form_submit reaches ur_process_registration() without nonce validation, meaning any unauthenticated request can reach the vulnerable code path.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-96660