8 matches found
CVE-2025-2563
CVE-2025-2563 concerns the WordPress plugin User Registration & Membership . Affected versions up to and including 4.1.1 fail to properly restrict the user role during account creation via the Membership Addon, allowing unauthenticated attackers to create accounts with administrator privileges. T...
CVE-2025-2594
The CVE-2025-2594 affects the WordPress plugin “User Registration & Membership” prior to version 4.1.3. Affected behavior: when the Membership Addon is enabled, data in an AJAX action is not properly validated, enabling an attacker to authenticate as any user (including administrators) by supplyi...
CVE-2023-27459
CVE-2023-27459 describes a Deserialization of Untrusted Data vulnerability in the WordPress plugin WordPress User Registration (WPEverest/Masteriyo) for versions through 2.3.2.1. The vulnerability enables authenticated subscribers to achieve PHP Object Injection via untrusted data deserialization...
CVE-2025-3292
CVE-2025-3292 concerns the WordPress plugin “User Registration & Membership – Custom Registration Form, Login Form, and User Profile.” It is vulnerable to Insecure Direct Object Reference due to missing validation on the user_id parameter, enabling update of other users’ passwords when an attacke...
CVE-2024-1720
CVE-2024-1720: WordPress Plugin—User Registration (Custom Registration Form, Login Form, User Profile). Stored XSS via the Display Name parameter affects all versions up to 3.1.4. Exploitation requires social engineering and a user to login, per description; Wordfence/Red Hat entries align with t...
CVE-2025-3282
CVE-2025-3282 affects the WordPress plugin User Registration & Membership – Custom Registration Form, Login Form, and User Profile . The flaw is an Insecure Direct Object Reference via the missing validation of the but publicly controllable key membership_id, enabling unauthenticated attackers to...
CVE-2025-30899
Technical details about CVE-2025-30899 are not provided in the supplied documents beyond the initial description (Stored XSS in wpeverest User Registration; affected version range from n/a through 4.0.3). Monitor for official advisories for fuller technical details and remediation.