Stored XSS in User Registration & Membership WordPress Plugin

The User Registration & Membership plugin for WordPress (versions 5.2.8 and below) is susceptible to a stored Cross-Site Scripting (XSS) vulnerability. The flaw exists because the plugin fails to properly sanitize input or escape output for checkbox field values. Furthermore, the nopriv AJAX action user_registration_user_form_submit lacks necessary nonce validation, allowing an unauthenticated remote attacker to reach the vulnerable code path via the ur_process_registration() function. Successful exploitation results in the execution of arbitrary JavaScript in the browser of any user who views the injected page, potentially leading to session hijacking, unauthorized actions, or further compromise of the WordPress site.

Attack Chain

1. The attacker discovers an endpoint utilizing the user_registration_user_form_submit AJAX action.
2. The attacker crafts an HTTP POST request targeting the registration endpoint.
3. The attacker populates the checkbox field value with a malicious JavaScript payload.
4. The request is sent to the WordPress webserver without a valid nonce.
5. The server-side code (ur_process_registration) fails to sanitize the checkbox input.
6. The malicious script is saved into the database as a field value.
7. A victim (often an administrator) navigates to the administrative page containing the injected content.
8. The victim's browser executes the injected payload in the context of the WordPress dashboard.

Impact

This vulnerability affects all users of the User Registration & Membership plugin versions 5.2.8 and earlier. Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of other users' sessions. In an administrative context, this can lead to full site compromise, creation of rogue administrator accounts, or exfiltration of sensitive configuration data.

Recommendation

Prioritized, concrete actions for detection engineering teams:

• Update the User Registration & Membership plugin to the latest version immediately to remediate CVE-2026-96660.
• Implement a Web Application Firewall (WAF) rule to block POST requests to the user_registration_user_form_submit action that contain script tags or common XSS patterns.
• Audit administrative WordPress logs for requests to user registration endpoints that lack legitimate session tokens or source headers.
• Use the webserver logs to monitor for repeated POST requests to the plugin's AJAX handler originating from suspicious or non-standard user agents.