EUVD-2026-76954

The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role...

EUVD-2026-76955

The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's ema...

EUVD-2026-76953

The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing...

CVE-2026-86406 User Registration & Membership < 5.2.8 - Subscriber+ Privilege Escalation via Membership Purchase

The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role...

CVE-2026-86407 User Registration & Membership < 5.2.8 - Unauthenticated User Data Disclosure via Membership Thank You Page

The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's ema...

WordPress User Registration & Membership plugin < 5.2.8 - Unauthenticated Open Redirect vulnerability

Unauthenticated Open Redirect vulnerability discovered by Sai Praneeth Koti in WordPress Plugin User Registration versions 5.2.8...

CVE-2026-80072 User Registration & Membership < 5.2.8 - Unauthenticated Open Redirect via Login Redirect Parameters

The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing...

CVE-2026-80071 User Registration & Membership < 5.2.8 - Author+ Privilege Escalation to Administrator

The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escala...

EUVD-2026-76952

The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escala...

CVE-2026-80071 User Registration & Membership < 5.2.8 - Author+ Privilege Escalation to Administrator

The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escala...

CVE-2026-80071

The User Registration & Membership WordPress plugin (versions before 5.2.8 ) is vulnerable to privilege escalation. The flaw exists because the plugin fails to properly restrict who can author a membership plan and lacks validation for the plans users attach to their own accounts. This allows aut...

Malicious code in iberia-user (npm)

--- Credit: OpenSSF source...

Malicious code in hello-user-test-npm-com-test (npm)

--- Credit: OpenSSF source...

Malicious code in google-user (npm)

--- Credit: OpenSSF source...

Malicious code in godaddy-user (npm)

Source: ossf-package-analysis 0952faaa9e03380da7ca100f669bfd7d1c69d691664ec13c1c10bfad931a5b43 The OpenSSF Package Analysis project identified 'godaddy-user' @ 999.9.9 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity...

EUVD-2026-76915

SEP sesam before 5.2.0.24 mishandles User Authorization with MFA. If AD authentication is configured and MFA is enforced, an attacker can create a second OTP access capability. SEP sesam and Active Directory handle username capitalization differently, which may allow multiple SEP sesam user...

CVE-2026-86406: Improper Privilege Management

The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role...

CVE-2026-90523: Improper Privilege Management

A vulnerability was identified in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The affected element is an unknown function of the file travel/src/main/java/com/controller/UsersController.java of the component User Register Endpoint. Such manipulation of...

CVE-2026-86407: Exposure of Sensitive Information to an Unauthorized Actor

The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's ema...

CVE-2026-80072: URL Redirection to Untrusted Site

The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing...