{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3auser_registration_and_membership_projectuser_registration_and_membershipwordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:user_registration_and_membership_project:user_registration_and_membership:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-96660"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["User Registration \u0026 Membership (\u003c= 5.2.8)"],"_cs_severities":["high"],"_cs_tags":["wordpress","xss","web-vulnerability"],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe User Registration \u0026amp; Membership plugin for WordPress (versions 5.2.8 and below) is susceptible to a stored Cross-Site Scripting (XSS) vulnerability. The flaw exists because the plugin fails to properly sanitize input or escape output for checkbox field values. Furthermore, the nopriv AJAX action user_registration_user_form_submit lacks necessary nonce validation, allowing an unauthenticated remote attacker to reach the vulnerable code path via the ur_process_registration() function. Successful exploitation results in the execution of arbitrary JavaScript in the browser of any user who views the injected page, potentially leading to session hijacking, unauthorized actions, or further compromise of the WordPress site.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker discovers an endpoint utilizing the user_registration_user_form_submit AJAX action.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts an HTTP POST request targeting the registration endpoint.\u003c/li\u003e\n\u003cli\u003eThe attacker populates the checkbox field value with a malicious JavaScript payload.\u003c/li\u003e\n\u003cli\u003eThe request is sent to the WordPress webserver without a valid nonce.\u003c/li\u003e\n\u003cli\u003eThe server-side code (ur_process_registration) fails to sanitize the checkbox input.\u003c/li\u003e\n\u003cli\u003eThe malicious script is saved into the database as a field value.\u003c/li\u003e\n\u003cli\u003eA victim (often an administrator) navigates to the administrative page containing the injected content.\u003c/li\u003e\n\u003cli\u003eThe victim's browser executes the injected payload in the context of the WordPress dashboard.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability affects all users of the User Registration \u0026amp; Membership plugin versions 5.2.8 and earlier. Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of other users' sessions. In an administrative context, this can lead to full site compromise, creation of rogue administrator accounts, or exfiltration of sensitive configuration data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized, concrete actions for detection engineering teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the User Registration \u0026amp; Membership plugin to the latest version immediately to remediate CVE-2026-96660.\u003c/li\u003e\n\u003cli\u003eImplement a Web Application Firewall (WAF) rule to block POST requests to the user_registration_user_form_submit action that contain script tags or common XSS patterns.\u003c/li\u003e\n\u003cli\u003eAudit administrative WordPress logs for requests to user registration endpoints that lack legitimate session tokens or source headers.\u003c/li\u003e\n\u003cli\u003eUse the webserver logs to monitor for repeated POST requests to the plugin's AJAX handler originating from suspicious or non-standard user agents.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-17T04:48:42Z","date_published":"2026-10-17T04:48:42Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-96660/","summary":"An unauthenticated stored XSS vulnerability in the User Registration \u0026 Membership plugin allows attackers to inject arbitrary scripts via the checkbox field due to missing nonce validation.","title":"Stored XSS in User Registration \u0026 Membership WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-96660/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:user_registration_and_membership_project:user_registration_and_membership:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}