CVE-2026-96660 wpeverest CVE debrief

Who should care

Defenders responsible for WordPress installations with the User Registration & Membership plugin should assess exposure and prioritize verification and potential updates. This includes reviewing the plugin's configuration to ensure proper input sanitization and output escaping, monitoring for potential script injection attempts, and planning vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

The User Registration & Membership plugin for WordPress has a Stored Cross-Site Scripting vulnerability, allowing unauthenticated attackers to inject web scripts. Defenders should prioritize verifying and updating the plugin and monitoring for potential script injection attempts.

• Unauthenticated attackers can inject web scripts that execute when a user accesses an injected page.
• The vulnerability allows for potential script injection attempts.
• Defenders need to verify and update the plugin to a fixed version, if available.

Technical summary

The User Registration & Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Checkbox Field Value in all versions up to, and including, 5.2.8. The nopriv AJAX action user_registration_user_form_submit reaches ur_process_registration() without nonce validation, allowing unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Defensive priority

Defenders should prioritize verifying and updating the User Registration & Membership plugin to a fixed version, if available, and monitor for potential script injection attempts.

Recommended defensive actions

• Verify and update the User Registration & Membership plugin to a fixed version, if available.
• Monitor for potential script injection attempts.
• Review and adjust the plugin's configuration to ensure proper input sanitization and output escaping.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability is due to insufficient input sanitization and output escaping in the nopriv AJAX action user_registration_user_form_submit, which reaches ur_process_registration() without nonce validation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.