CVE-2026-92798

The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrer url' branch of UR Smart Tags::process(), where the attacker-controlled HTTP REFERER header is only passed through sanitize text field() — which does not strip WordPress shortcode delimiters — before being substituted into a Content Restriction message that is subsequently executed via apply shortcodes()/do shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes on any restricted page whose message uses the supported {{referrer url}} smart tag.