Unknown User Registration vulnerabilities

• unknown user registration & membership User Registration & Membership < 5.2.8 - Unauthenticated User Data Disclosure via Membership Thank You Page CVE-2026-86407 3.7 LowSeptember 13, 2026
• unknown user registration & membership User Registration & Membership < 5.2.8 - Subscriber+ Privilege Escalation via Membership Purchase CVE-2026-86406 7.5 HighSeptember 13, 2026
• unknown user registration & membership User Registration & Membership < 5.2.8 - Unauthenticated Open Redirect via Login Redirect Parameters CVE-2026-80072 4.7 MediumSeptember 13, 2026
• unknown user registration & membership User Registration & Membership < 5.2.8 - Author+ Privilege Escalation to Administrator CVE-2026-80071 7.2 HighSeptember 13, 2026
• unknown user registration & membership User Registration & Membership < 5.2.6 - Authenticated Privilege Escalation via Login Settings CVE-2026-79996 7.2 HighAugust 28, 2026
• unknown user registration & membership User Registration & Membership < 5.2.5 - Subscriber+ Pending Email Change Cancellation via IDOR CVE-2026-79995 4.3 MediumAugust 28, 2026
• unknown user registration & membership User Registration & Membership < 5.2.6 - Unauthenticated Account Creation While Registration Disabled CVE-2026-16736 7.5 HighAugust 5, 2026
• unknown user frontend: ai powered frontend post submission, user directory, user profile, membership & user registration WP User Frontend < 4.3.8 - Unauthenticated Author-less Attachment Deletion CVE-2026-14568 6.5 MediumJuly 27, 2026
• unknown paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content ProfilePress < 4.16.18 - Unauthenticated Privilege Escalation via Registration Role Selection CVE-2026-12497 7.5 HighJuly 24, 2026
• unknown user registration & membership User Registration & Membership < 5.2.3 - Unauthenticated Limited User Deletion via Stripe Subscription Handler CVE-2026-11966 5.3 MediumJuly 17, 2026
• unknown user registration & membership User Registration & Membership < 5.2.3 - Unauthenticated Privilege Escalation via Unbound members_data Membership ID CVE-2026-11961 8.1 HighJuly 17, 2026
• unknown user registration & membership User Registration & Membership < 5.2.2 - Unauthenticated PayPal Webhook Signature Verification Bypass Leading to Membership Activation CVE-2026-11964 9.1 CriticalJuly 13, 2026
• unknown user registration & membership User Registration & Membership < 5.2.2 - Subscriber+ Cross-User Role and Membership Tier Modification via IDOR CVE-2026-11963 8.1 HighJuly 13, 2026
• unknown user registration & membership User Registration & Membership < 5.2.0 - Unauthenticated Paid Membership Bypass CVE-2026-11965 6.5 MediumJuly 2, 2026
• unknown paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content ProfilePress < 4.16.17 - Subscriber+ Subscription Cancellation via IDOR CVE-2026-10820 8.1 HighJune 27, 2026
• unknown user registration & membership, wpeverest user registration \& membership +1 more User Registration & Membership < 4.1.3 - Authentication Bypass CVE-2025-2594 Public exploit 8.1 HighApril 22, 2025
• unknown user registration & membership, wpeverest user registration \& membership +1 more User Registration & Membership < 4.1.2- Unauthenticated Privilege Escalation CVE-2025-2563 Public exploit EPSS 49.1% 8.1 HighApril 14, 2025
• unknown paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content, properfraction profilepress +1 more Paid Membership Plugin < 4.15.20 - Admin+ Stored XSS CVE-2024-13121 3.5 LowFebruary 13, 2025
• properfraction profilepress, unknown paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content +1 more ProfilePress < 4.15.20 - Admin+ Stored XSS CVE-2024-13120 4.8 MediumFebruary 13, 2025
• properfraction profilepress, unknown paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content +1 more ProfilePress < 4.15.20 - Admin+ Stored XSS CVE-2024-13119 4.8 MediumFebruary 13, 2025
• properfraction profilepress, unknown paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content +1 more ProfilePress < 4.15.15 - Admin+ Stored XSS CVE-2024-10518 4.8 MediumDecember 12, 2024
• properfraction profilepress, unknown paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content +1 more ProfilePress < 4.15.15 - Admin+ Stored XSS CVE-2024-10517 4.8 MediumDecember 12, 2024
• unknown user registration, strategy11 user registration forms +1 more Formidable Registration < 2.12 - Contributor+ Arbitrary User Password Reset To Account Takeover CVE-2024-1290 6.5 MediumMarch 11, 2024
• unknown user registration & user profile, wpuserplus userplus +1 more UserPlus <= 2.0 - Stored XSS via CSRF CVE-2023-0824 6.5 MediumJanuary 16, 2024
• unknown user registration User Registration < 3.0.4.2 - Admin+ Stored XSS CVE-2023-5228 4.8 MediumNovember 6, 2023
• paidmembershipspro custom user profile fields for user registration, unknown custom user profile fields for user registration & member frontend profiles with paid memberships pro +1 more Custom User Profile Fields for User Registration & Member Frontend Profiles with Paid Memberships Pro < 1.8.1 - Contributor+ Stored XSS via Shortcode CVE-2022-4831 5.4 MediumJanuary 30, 2023
• unknown user registration User Registration < 2.2.4.1 - Subscriber+ Arbitrary File Upload CVE-2022-3912 7.5 HighDecember 12, 2022
• cozmoslabs profile builder, unknown profile builder – user profile & user registration forms +1 more Profile Builder < 3.6.8 - Admin+ Stored Cross-Site Scripting CVE-2022-0884 4.8 MediumApril 4, 2022
• ayecode userswp, unknown userswp – user registration & user profile +1 more UsersWP < 1.2.3.1 - Subscriber+ User Avatar Override CVE-2022-0442 4.3 MediumMarch 7, 2022
• metagauss registrationmagic, unknown registrationmagic – custom registration forms, user registration and user login plugin +1 more RegistrationMagic < 5.0.2.2 - Admin+ SQL Injection CVE-2022-0420 7.2 HighMarch 7, 2022
• cozmoslabs profile builder – user profile & user registration forms, profile builder +1 more Profile Builder – User Profile & User Registration Forms <= 3.6.1 Reflected Cross-Site Scripting CVE-2022-0653 6.1 MediumFebruary 24, 2022
• metagauss registrationmagic, unknown registrationmagic – custom registration forms, user registration and user login plugin +1 more RegistrationMagic < 5.0.1.6 - Admin+ SQL Injection CVE-2021-24862 Public exploit EPSS 72.7% 7.2 HighJanuary 10, 2022
• profilepress user registration\, login form\, user profile \& membership, unknown user registration, login form, user profile & membership – profilepress (formerly wp user avatar) +1 more ProfilePress < 3.2.3 - Reflected Cross-Site Scripting CVE-2021-24955 6.1 MediumDecember 13, 2021
• profilepress user registration\, login form\, user profile \& membership, unknown user registration, login form, user profile & membership – profilepress (formerly wp user avatar) +1 more ProfilePress < 3.2.3 - Reflected Cross-Site Scripting CVE-2021-24954 6.1 MediumDecember 13, 2021
• wpeverest user registration, unknown user registration – custom registration form, login and user profile for wordpress +1 more User Registration < 2.0.2 - Low Privilege Stored Cross-Site Scripting CVE-2021-24654 5.4 MediumOctober 4, 2021
• cozmoslabs profile builder, unknown user registration & user profile – profile builder +1 more Profile Builder < 3.4.9 - Admin Access via Password Reset CVE-2021-24527 9.8 CriticalAugust 16, 2021
• properfraction profilepress, unknown user registration, user profile, login & membership – profilepress (formerly wp user avatar) +1 more ProfilePress < 3.1.11 - Unauthenticated Cross-Site Scripting (XSS) in tabbed login/register widget CVE-2021-24522 6.1 MediumAugust 9, 2021
• properfraction profilepress, unknown user registration, user profiles, login & membership – profilepress (formerly wp user avatar) +1 more ProfilePress < 3.1.8 - Authenticated Stored XSS CVE-2021-24450 4.8 MediumAugust 2, 2021
• cozmoslabs profile builder, unknown user registration & user profile – profile builder +1 more Profile Builder < 3.4.8 - Authenticated Stored XSS CVE-2021-24448 4.8 MediumAugust 2, 2021
• genetechsolutions pie register, unknown pie register – user registration forms. invitation based registrations, custom login, payments +1 more Pie Register < 3.7.0.1 - Reflected Cross-Site Scripting (XSS) CVE-2021-24239 6.1 MediumApril 22, 2021