CVE-2026-87111

Name of the Vulnerable Software and Affected Versions User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin versions prior to 6.3.0

Description The premium build of the plugin contains a flaw due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server, by manipulating the HTTP Referer Header. These scripts execute whenever a user visits the affected page. The attack is facilitated by the fact that the nonce required to access the vulnerable AJAX endpoint is available in the page source for anonymous visitors.

Recommendations Update the plugin to a version newer than 6.2.9.