Zitadel - User Registration Bypass

The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7, disabling the "User Registration allowed" option only hid the...

User Registration & Membership WordPress plugin - Open Redirect

User Registration & Membership WordPress plugin = 5.1.4 contains an open redirect caused by insufficient validation of 'redirecttoonlogout' parameter, letting attackers redirect users to malicious external URLs after logout, exploit requires crafted URL. id: CVE-2026-6203 info: name: User...

Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation

The Simple User Registration plugin ≤ 6.3 is vulnerable to privilege escalation. It lacks proper restrictions on user meta values during registration. Unauthenticated attackers can exploit this to register as administrators. id: CVE-2025-4334 info: name: Simple User Registration = 6.3 -...

WordPress User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation

User Registration & Membership WordPress plugin = 5.1.2 contains an improper privilege management vulnerability caused by accepting user-supplied roles without server-side allowlist enforcement, letting unauthenticated attackers create administrator accounts id: CVE-2026-1492 info: name: WordPres...

XWiki < 4.10.20 - Remote code execution

XWiki is vulnerable to a remote code execution RCE attack through its user registration feature. This issue allows an attacker to execute arbitrary code by crafting malicious payloads in the "first name" or "last name" fields during user registration. This impacts all installations that have user...

CVE-2026-74001

Unauthenticated Broken Authentication in User Registration & Membership Pro = 5.4.5 versions...

EUVD-2026-63314

Unauthenticated Broken Authentication in User Registration & Membership Pro = 5.4.5 versions...

CVE-2026-74001

User Registration & Membership Pro is a WordPress plugin affected by an unauthenticated broken authentication vulnerability in versions ≤ 5.4.5 , enabling account takeover without any prior credentials. The flaw was discovered by 0xd4rk5id3 and carries a CVSS 3.1 score of 9.8 (CRITICAL) with a ne...

CVE-2026-74001 WordPress User Registration & Membership Pro plugin <= 5.4.5 - Account Takeover vulnerability

Unauthenticated Broken Authentication in User Registration & Membership Pro = 5.4.5 versions...

CVE-2026-73995

Subscriber Broken Authentication in User Registration = 5.2.6 versions...

EUVD-2026-60809

Subscriber Broken Authentication in User Registration = 5.2.6 versions...

CVE-2026-73995 WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability

Subscriber Broken Authentication in User Registration = 5.2.6 versions...

CVE-2026-73995

The WordPress User Registration plugin (versions ≤ 5.2.6) has a broken authentication flaw allowing subscribers to bypass access controls; CVSS 5.4 (MEDIUM). CISA SSVC reports no active exploitation. No exploit code is provided; upgrade beyond 5.2.6 to remediate. Details via Patchstack reference.

WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by DmTomHe in WordPress Plugin User Registration versions = 5.2.6...

CVE-2026-73403

Unauthenticated Broken Access Control in User Registration = 5.2.6 versions...

CVE-2026-73403 WordPress User Registration plugin <= 5.2.6 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in User Registration = 5.2.6 versions...

EUVD-2026-57916

Unauthenticated Broken Access Control in User Registration = 5.2.6 versions...

CVE-2026-73403

The CVE-2026-73403 entry concerns the WordPress User Registration plugin (versions ≤ 5.2.6) with unauthenticated broken access control in its registration flow. Affected software: WordPress User Registration plugin; vulnerable component: registration/authentication logic described as enforcing br...

WordPress User Registration plugin <= 5.2.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ziming Zhang in WordPress Plugin User Registration versions = 5.2.6...

EUVD-2026-56137

AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that persists in the database. When administrators visit the users management page, the unsanitized phone value is rendered via innerHTML, executing the injected...