User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

Vulnerabilities 38Slug user-registrationLatest version 5.1.6WordPress.org →

Minimum safe version

5.1.6

Update to 5.1.6 or later to address 38 fixable vulnerabilities

Latest available5.1.6 ✓
N/A
2025-09-05< 4.4.0

User Registration & Membership <= 4.3.0 - Authenticated (Admin+) SQL Injection

WordfenceCVE
N/A
2026-02-25< 5.1.3

User Registration & Membership <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion

WordfenceCVE
N/A
2026-02-25< 5.1.3

User Registration & Membership <= 5.1.2 - Authentication Bypass

WordfenceCVE
N/A
2026-03-02< 5.1.3

User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration

WordfenceCVE
N/A
2026-03-23< 5.1.5

User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation

WordfenceCVE
Medium 6.5
2026-04-08< 5.1.3

User Registration & Membership <= 5.1.2 - Authenticated (Subscriber+) SQL Injection via membership_ids[]

EUVDWordfenceCVE
Medium 6.4
2025-07-22< 4.3.0

User Registration <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via urcr_restrict Shortcode

EUVDWordfenceCVE
Medium 5.3
2025-05-06< 4.2.2

User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.2.1 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion

EUVDWordfenceCVE
Medium 5.3
2025-04-12< 4.1.4

User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Unauthenticated Membership Modification

EUVDWordfenceCVE
Medium 4.3
2025-04-12< 4.1.4

User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Password Update

EUVDWordfenceCVE
High 8.1
2025-04-01< 4.1.3

User Registration & Membership <= 4.1.2 - Authentication Bypass

WordfenceCVE
High 8.1
2025-04-14< 4.1.2

User Registration & Membership <= 4.1.1 - Unauthenticated Privilege Escalation

EUVDWordfenceCVEWordfence
Medium 6.1
2025-02-28< 4.1.0

WordPress User Registration Plugin <= 4.0.4 is vulnerable to Cross Site Scripting (XSS)

PatchstackEUVDWordfenceCVE
High 7.1
2024-06-03< 3.2.1

WordPress User Registration Plugin <= 3.2.0.1 is vulnerable to Broken Access Control

PatchstackCVEWordfence
Medium 4.8
2023-11-07< 3.0.4.2

WordPress User Registration Plugin < 3.0.4.2 is vulnerable to Cross Site Scripting (XSS)

PatchstackCVEWordfenceWPScan
N/A
2019-01-09< 1.5.6

User Registration <= 1.5.5 - Cross-Site Scripting

Wordfence
N/A
< 1.5.6

User Registration &lt;= 1.5.5 - Authenticated Cross-Site Scripting (XSS)

WPScan
N/A
2019-01-14< 1.5.6

WordPress User Registration plugin <= 1.5.5 - Authenticated Cross-Site Scripting (XSS) vulnerability

Patchstack