{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/user-registration-pro--6.2.9/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:userregistration:user_registration_pro:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-87111"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["User Registration PRO (\u003c= 6.2.9)"],"_cs_severities":["high"],"_cs_tags":["wordpress","xss","cve-2026-87111","vulnerability"],"_cs_type":"advisory","_cs_vendors":["User Registration"],"content_html":"\u003cp\u003eThe premium version of the User Registration PRO WordPress plugin (versions 6.2.9 and earlier) is vulnerable to stored cross-site scripting (XSS). The vulnerability stems from insufficient sanitization and escaping of the HTTP Referer header before it is processed and stored by the plugin. Because the nonce required to interact with the vulnerable AJAX endpoint is exposed in the source code of front-end pages, unauthenticated attackers can successfully conduct this attack. When an administrator or another user views the page where the malicious script was stored, the script executes within the context of their session, potentially leading to unauthorized actions or account compromise. This vulnerability is specific to the premium build of the plugin and does not affect the free version distributed via WordPress.org.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the browsers of users who visit the affected pages. This can lead to session hijacking, unauthorized administrative actions, or the redirection of users to malicious external domains. As this plugin is used for custom registration and profile management, the impact is heightened due to the potential for attackers to gain elevated privileges or exfiltrate sensitive user data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the User Registration PRO plugin to the latest version, ensuring the patch for CVE-2026-87111 is applied immediately.\u003c/li\u003e\n\u003cli\u003eImplement or review Web Application Firewall (WAF) rules to detect and block abnormal or malformed HTTP Referer headers containing script tags or JavaScript event handlers.\u003c/li\u003e\n\u003cli\u003ePerform a security audit of the plugin configuration and logs to identify any unauthorized registration attempts or anomalous AJAX activity.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T08:26:11Z","date_published":"2026-10-16T08:26:11Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-87111/","summary":"An unauthenticated stored cross-site scripting vulnerability in the User Registration PRO premium WordPress plugin allows attackers to inject malicious scripts via the HTTP Referer header.","title":"Stored XSS in User Registration PRO WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-87111/"}],"language":"en","title":"CraftedSignal Threat Feed - User Registration PRO (\u003c= 6.2.9)","version":"https://jsonfeed.org/version/1.1"}