User Registration - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/user-registration/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 16 Oct 2026 08:26:11 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStored XSS in User Registration PRO WordPress Pluginhttps://feed.craftedsignal.io/briefs/2026-10-cve-2026-87111/Fri, 16 Oct 2026 08:26:11 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-cve-2026-87111/An unauthenticated stored cross-site scripting vulnerability in the User Registration PRO premium WordPress plugin allows attackers to inject malicious scripts via the HTTP Referer header.The premium version of the User Registration PRO WordPress plugin (versions 6.2.9 and earlier) is vulnerable to stored cross-site scripting (XSS). The vulnerability stems from insufficient sanitization and escaping of the HTTP Referer header before it is processed and stored by the plugin. Because the nonce required to interact with the vulnerable AJAX endpoint is exposed in the source code of front-end pages, unauthenticated attackers can successfully conduct this attack. When an administrator or another user views the page where the malicious script was stored, the script executes within the context of their session, potentially leading to unauthorized actions or account compromise. This vulnerability is specific to the premium build of the plugin and does not affect the free version distributed via WordPress.org.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the browsers of users who visit the affected pages. This can lead to session hijacking, unauthorized administrative actions, or the redirection of users to malicious external domains. As this plugin is used for custom registration and profile management, the impact is heightened due to the potential for attackers to gain elevated privileges or exfiltrate sensitive user data.

Recommendation

  • Update the User Registration PRO plugin to the latest version, ensuring the patch for CVE-2026-87111 is applied immediately.
  • Implement or review Web Application Firewall (WAF) rules to detect and block abnormal or malformed HTTP Referer headers containing script tags or JavaScript event handlers.
  • Perform a security audit of the plugin configuration and logs to identify any unauthorized registration attempts or anomalous AJAX activity.
]]>highadvisorywordpressxsscve-2026-87111vulnerability