CVE-2026-87111
Received Received - Intake

Stored XSS in User Registration PRO WordPress Plugin

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Wordfence

Description
The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Referer Header in all versions up to, and including, 6.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is present only in the premium build of the plugin and is not present in the free WordPress.org distribution. The nonce required to call the vulnerable AJAX endpoint is localized into the page source of every front-end page for anonymous visitors, making it fully obtainable by unauthenticated attackers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-87111
EUVD
EUVD-2026-102814

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
WPEverest User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the User Registration PRO WordPress plugin. It allows unauthenticated attackers to inject malicious scripts via the HTTP Referer header due to insufficient input sanitization and output escaping. The injected scripts execute when users access the affected pages. This flaw exists only in the premium version of the plugin, not the free WordPress.org version.

Detection Guidance

Check if the premium User Registration PRO plugin version 6.2.9 or lower is installed. Inspect HTTP Referer headers for stored scripts in WordPress pages. Use WordPress security plugins to scan for malicious scripts in page sources.

Impact Analysis

Unauthenticated attackers could steal user sessions, redirect users to malicious sites, or perform actions on their behalf. Since the nonce is exposed in page source for anonymous visitors, attackers can exploit this to inject scripts that execute whenever a user visits an affected page.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. It may result in data breaches, non-compliance penalties, and loss of user trust due to compromised personal or sensitive data.

Mitigation Strategies

Update the User Registration PRO plugin to the latest version beyond 6.2.9. If using the premium version, contact the vendor for a patched build. Disable the plugin temporarily if an update is unavailable. Monitor WordPress sites for unexpected script injections.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87111. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart