User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
user-registration · plugin
Known security vulnerabilities for User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder. Find out in seconds which version runs on your site with WP Lens.
38 known vulnerabilities
2 critical · 4 with public exploit code · latest Sep 17, 2026
Vulnerabilities
- Critical 9.9
User Registration <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Upload
- Critical 9.8
User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration
- High 8.8
User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Priv
- High 8.8
WordPress User Registration plugin <= 2.3.2.1 - Authenticated PHP Object Injection vulnerability
- High 8.8
User Registration <= 3.0.1 - Authenticated (Subscriber+) PHP Object Injection
- High 8.2
WordPress User Registration plugin <= 4.4.6 - Broken Access Control vulnerability
- High 8.1
WordPress User Registration plugin <= 4.4.9 - Privilege Escalation vulnerability
- High 8.1
User Registration & Membership <= 5.1.2 - Authentication Bypass
- High 7.5
WordPress User Registration plugin <= 5.1.2 - Broken Access Control vulnerability
- High 7.1
WordPress User Registration plugin <= 5.1.5 - Cross Site Scripting (XSS) vulnerability
- High 7.1
User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.2.0.1 - Missing Authorization to Privilege Escalation
- Medium 6.5
WordPress User Registration plugin <= 5.2.2 - Broken Access Control vulnerability
- Medium 6.5
User Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypass
- Medium 6.5
User Registration & Membership <= 5.1.2 - Authenticated (Subscriber+) SQL Injection via membership_ids[]
- Medium 6.5
User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Unauthenticated Media Deletion
- Medium 6.4
User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin <= 4.4.6 - Authentic
- Medium 6.4
User Registration <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via urcr_restrict Shortcode
- Medium 6.1
User Registration & Membership <= 5.1.4 - Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter
- Medium 6.1
WordPress User Registration plugin < 4.2.0 - Reflected Cross Site Scripting (XSS) vulnerability
- Medium 6.1
User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.0.4 - Reflected Cross-Site Scripting
- Medium 6.1
User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.4 - Unauthenticated Stored Self-Based Cross-Site Scripting
- Medium 5.4
WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability
- Medium 5.4
User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation
- Medium 5.4
User Registration & Membership <= 4.4.8 - Cross-Site Request Forgery to Arbitrary Post Deletion
- Medium 5.3
WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability
- Medium 5.3
WordPress User Registration plugin <= 5.2.6 - Broken Access Control vulnerability
- Medium 5.3
User Registration & Membership <= 5.1.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via 'profile-pic-url' Paramet
- Medium 5.3
User Registration & Membership <= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter
- Medium 5.3
User Registration & Membership <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion
- Medium 5.3
User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.2.1 - Insecure Direct Object Reference to Unauthenticated Limited U
- Medium 5.3
User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Unauthenticated Membershi
- Medium 5.3
WordPress User Registration plugin <= 2.3.2.1 - Broken Access Control vulnerability
- Medium 4.9
User Registration & Membership <= 4.3.0 - Authenticated (Admin+) SQL Injection
- Medium 4.8
WordPress User Registration plugin <= 4.0.3 - Cross Site Scripting (XSS) vulnerability
- Medium 4.8
WordPress User Registration Plugin <= 2.3.0 is vulnerable to Cross Site Scripting (XSS)
- Medium 4.3
User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Limited Page Content Modification
- Medium 4.3
WordPress User Registration plugin <= 4.4.9 - Arbitrary Shortcode Execution vulnerability
- Medium 4.3
User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Authenticated (Subscriber