What’s Vulnerable › Products
User Registration & Membership vulnerabilities
27 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 25 published in the last 12 months.
Check whether your User Registration & Membership version is affected
Latest User Registration & Membership vulnerabilities
- CVE-2026-74017 — WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability (CVSS 5.3)
- CVE-2026-86407 — User Registration & Membership < 5.2.8 - Unauthenticated User Data Disclosure via Membership Thank You Page (CVSS 3.7)
- CVE-2026-86406 — User Registration & Membership < 5.2.8 - Subscriber+ Privilege Escalation via Membership Purchase (CVSS 7.5)
- CVE-2026-80072 — User Registration & Membership < 5.2.8 - Unauthenticated Open Redirect via Login Redirect Parameters (CVSS 4.7)
- CVE-2026-80071 — User Registration & Membership < 5.2.8 - Author+ Privilege Escalation to Administrator (CVSS 7.2)
- CVE-2026-79996 — User Registration & Membership < 5.2.6 - Authenticated Privilege Escalation via Login Settings (CVSS 7.2)
- CVE-2026-79995 — User Registration & Membership < 5.2.5 - Subscriber+ Pending Email Change Cancellation via IDOR (CVSS 4.3)
- CVE-2026-73995 — WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability (CVSS 5.4)
- CVE-2026-73403 — WordPress User Registration plugin <= 5.2.6 - Broken Access Control vulnerability (CVSS 5.3)
- CVE-2026-16736 — User Registration & Membership < 5.2.6 - Unauthenticated Account Creation While Registration Disabled (CVSS 7.5)
- CVE-2026-11966 — User Registration & Membership < 5.2.3 - Unauthenticated Limited User Deletion via Stripe Subscription Handler (CVSS 5.3)
- CVE-2026-11961 — User Registration & Membership < 5.2.3 - Unauthenticated Privilege Escalation via Unbound members_data Membership ID (CVSS 8.1)
- CVE-2026-11964 — User Registration & Membership < 5.2.2 - Unauthenticated PayPal Webhook Signature Verification Bypass Leading to Membership Activation (CVSS 9.1)
- CVE-2026-11963 — User Registration & Membership < 5.2.2 - Subscriber+ Cross-User Role and Membership Tier Modification via IDOR (CVSS 8.1)
- CVE-2026-11965 — User Registration & Membership < 5.2.0 - Unauthenticated Paid Membership Bypass (CVSS 6.5)
- CVE-2026-42652 — WordPress User Registration plugin <= 5.1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2026-32488 — WordPress User Registration plugin <= 4.4.9 - Privilege Escalation vulnerability (CVSS 8.1)
- CVE-2026-24353 — WordPress User Registration plugin <= 4.4.9 - Arbitrary Shortcode Execution vulnerability (CVSS 4.3)
- CVE-2025-67956 — WordPress User Registration plugin <= 4.4.6 - Broken Access Control vulnerability (CVSS 8.2)
- CVE-2025-39400 — WordPress User Registration plugin < 4.2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 6.1)
- CVE-2025-2594 — User Registration & Membership < 4.1.3 - Authentication Bypass (CVSS 8.1)
- CVE-2025-2563 — User Registration & Membership < 4.1.2- Unauthenticated Privilege Escalation (CVSS 8.1)
- CVE-2025-3292 — User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Password Update (CVSS 4.3)
- CVE-2025-3282 — User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Unauthenticated Membership Modification (CVSS 5.3)
- CVE-2025-30899 — WordPress User Registration plugin <= 4.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 4.8)