UR
Product
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
28
CVEs
0
On KEV
9.9
Max CVSS
4
New 30D
Severity mix
Critical 2High 6Medium 20Low 0
Watch
Add User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-1869 | 6.5 | Jun 26 | User Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypass Affected: through 5.2.0 |
| CVE-2026-1865 | 6.5 | Apr 8 | User Registration & Membership <= 5.1.2 - Authenticated (Subscriber+) SQL Injection via membership_ids[] Affected: through 5.1.2 |
| CVE-2024-3295 | 6.5 | May 2 | User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Unauthenticated Media Deletion Affected: through 3.1.5 |
| CVE-2025-13367 | 6.4 | Dec 15 | User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Affected: through 4.4.6 |
| CVE-2025-6831 | 6.4 | Jul 22 | User Registration <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via urcr_restrict Shortcode Affected: through 4.2.4 |
| CVE-2026-6203 | 6.1 | Apr 13 | User Registration & Membership <= 5.1.4 - Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter Affected: through 5.1.4 |
| CVE-2025-1511 | 6.1 | Feb 28 | User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.0.4 - Reflected Cross-Site Scripting Affected: through 4.0.4 |
| CVE-2024-1720 | 6.1 | Mar 7 | User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.4 - Unauthenticated Stored Self-Based Cross-Site Scripting Affected: through 3.1.4 |
| CVE-2026-15222 | 5.4 | Oct 16 | User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name Affected: through 5.2.8 |
| CVE-2026-4056 | 5.4 | Mar 23 | User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation Affected: through 5.1.4 |
| CVE-2025-14976 | 5.4 | Jan 10 | User Registration & Membership <= 4.4.8 - Cross-Site Request Forgery to Arbitrary Post Deletion Affected: through 4.4.8 |
| CVE-2026-7651 | 5.3 | May 28 | User Registration & Membership <= 5.1.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via 'profile-pic-url' Parameter Affected: through 5.1.5 |
| CVE-2026-6145 | 5.3 | May 14 | User Registration & Membership <= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter Affected: through 5.1.5 |
| CVE-2026-2356 | 5.3 | Feb 26 | User Registration & Membership <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion Affected: through 5.1.2 |
| CVE-2025-3281 | 5.3 | May 6 | User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.2.1 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion Affected: through 4.2.1 |
| CVE-2025-3282 | 5.3 | Apr 12 | User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Unauthenticated Membership Modification Affected: through 4.1.3 |
| CVE-2025-9085 | 4.9 | Sep 6 | User Registration & Membership <= 4.3.0 - Authenticated (Admin+) SQL Injection Affected: through 4.3.0 |
| CVE-2026-92978 | 4.3 | Oct 17 | User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action() Affected: through 5.2.8 |
| CVE-2026-3601 | 4.3 | May 5 | User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Limited Page Content Modification Affected: through 5.1.4 |
| CVE-2025-3292 | 4.3 | Apr 12 | User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Password Update Affected: through 4.1.3 |
Showing 20