WordPress plugin
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 73 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical4
- High11
- Medium58
- Low0
All User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder vulnerabilities
- Medium5.3Missing Authorization
≤5.3.1Update to 5.3.2
- Medium4.3Missing Authorization
≤5.3.0Update to 5.3.1
- Medium5.3Missing Authorization
≤5.3.1Update to 5.3.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤5.3.0Update to 5.3.1
- Medium5.3Missing Authorization
≤5.3.0Update to 5.3.1
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
≤5.3.0Update to 5.3.1
- High8.1Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag
≤5.2.8Update to 5.3.0
- Medium4.3Cross-Site Request Forgery to trigger_bulk_action()
≤5.2.8Update to 5.3.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value
≤5.2.8Update to 5.3.0
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name
≤5.2.8Update to 5.3.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤5.2.8Update to 5.3.0
- Medium4.3Missing Authorization
≤5.2.8Update to 5.3.0
- Medium5.3Missing Authorization
≤5.2.8Update to 5.3.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.2.8Update to 5.3.0
- Medium4.3Cross-Site Request Forgery
≤5.2.8Update to 5.3.0
- Medium5.3Missing Authorization
≤5.2.8Update to 5.3.0
- Medium5.3Unauthenticated Information Exposure
≤5.2.8Update to 5.3.0
- Medium5.3Missing Authorization
≤5.2.7Update to 5.2.8
- Medium5.3Missing Authorization
≤5.2.7Update to 5.2.8
- Medium6.35.2.7 - Authenticated (Subscriber+) Privilege Escalation
4.4.6 – 5.2.7Update to 5.2.8
- Medium6.3Authenticated (Author+) Privilege Escalation
<5.2.8Update to 5.2.8
- Medium5.35.2.7 - Unauthenticated Information Exposure
5.0 – 5.2.7Update to 5.2.8
- High7.2Unauthenticated Open Redirect
<5.2.8Update to 5.2.8
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
<5.2.5Update to 5.2.5
- Medium6.3Authenticated (Custom Role+) Privilege Escalation
<5.2.6Update to 5.2.6
- Medium4.3Missing Authorization
≤5.2.6Update to 5.2.7
- Medium5.3Missing Authorization
≤5.2.6Update to 5.2.7
- Medium5.3Missing Authorization to Unauthenticated Account Creation While Registration Disabled
≤5.2.5Update to 5.2.6
- High8.1Unauthenticated Privilege Escalation
≤5.2.2Update to 5.2.3
- Medium5.3Missing Authorization to Unauthenticated User Deletion via Stripe Handler
≤5.2.2Update to 5.2.3
- Medium6.5Missing Authorization to Unauthenticated Payment Bypass
≤5.2.0Update to 5.2.1
- Medium5.3Missing Authorization
≤5.2.2Update to 5.2.3
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference to Membership Tier Modification
≤5.2.1Update to 5.2.2
- Medium5.3Unauthenticated PayPal Bypass to Membership Activation
≤5.2.1Update to 5.2.2
- Medium5.3Unauthenticated Payment Bypass
≤5.1.0Update to 5.2.0
- Medium5.3Missing Authorization
≤5.1.2Update to 5.1.3
- Medium5.3Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via 'profile-pic-url' Parameter
≤5.1.5Update to 5.1.6
- Medium5.3Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter
≤5.1.5Update to 5.1.6
- Medium4.3Missing Authorization to Authenticated (Contributor+) Limited Page Content Modification
≤5.1.4Update to 5.1.5
- Medium6.1Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter
≤5.1.4Update to 5.1.5
- Medium6.1Reflected Cross-Site Scripting
≤5.1.5Update to 5.1.6
- Medium6.5Authenticated (Subscriber+) SQL Injection via membership_ids[]
≤5.1.2Update to 5.1.3
- Medium5.4Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation
≤5.1.4Update to 5.1.5
- Critical9.8Unauthenticated Remote Code Execution
≤4.4.9Update to 5.1.3
- Critical9.8Unauthenticated Privilege Escalation via Membership Registration
≤5.1.2Update to 5.1.3
- Medium5.3Insecure Direct Object Reference to Unauthenticated Limited User Deletion
≤5.1.2Update to 5.1.3
- High8.1Authentication Bypass
≤5.1.2Update to 5.1.3
- Medium5.3Missing Authorization
≤4.4.6Update to 4.4.7
- Medium5.4Cross-Site Request Forgery to Arbitrary Post Deletion
≤4.4.8Update to 4.4.9
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution
≤4.4.9Update to 5.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
≤4.4.6Update to 4.4.7
- Medium4.9Authenticated (Admin+) SQL Injection
≤4.3.0Update to 4.4.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via urcr_restrict Shortcode
≤4.2.4Update to 4.3.0
- Medium5.3Insecure Direct Object Reference to Unauthenticated Limited User Deletion
≤4.2.1Update to 4.2.2
- Medium6.1Reflected Cross-Site Scripting
≤4.1.5Update to 4.2.0
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) User Password Update
≤4.1.3Update to 4.1.4
- Medium5.3Insecure Direct Object Reference to Unauthenticated Membership Modification
≤4.1.3Update to 4.1.4
- High8.1Authentication Bypass
≤4.1.2Update to 4.1.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤4.0.3Update to 4.0.4
- Critical9.8Unauthenticated Privilege Escalation
≤4.1.1Update to 4.1.2
- Medium6.1Reflected Cross-Site Scripting
≤4.0.4Update to 4.1.0
- High7.1Missing Authorization to Privilege Escalation
≤3.2.0.1Update to 3.2.1
- High8.8Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
≤3.1.5Update to 3.2.0
- Medium6.5Missing Authorization to Unauthenticated Media Deletion
≤3.1.5Update to 3.2.0
- Medium4.7Unauthenticated Stored Self-Based Cross-Site Scripting
≤3.1.4Update to 3.1.5
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤3.0.4.1Update to 3.0.4.2
- Critical9.9Authenticated (Subscriber+) Arbitrary File Upload
≤3.0.2Update to 3.0.2.1
- High8.8Authenticated (Subscriber+) PHP Object Injection
≤3.0.1Update to 3.0.2
- Medium5.3Missing Authorization via send_test_email
≤2.3.2.1Update to 2.3.3
- High7.5PHP Object Injection
≤2.3.2.1Update to 2.3.3
- Medium5.5Authenticated (Administrator+) Stored Cross Site Scripting
≤2.3.0Update to 2.3.1
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
≤2.2.4Update to 2.2.41
- Medium6.4Cross-Site Scripting
≤1.5.5Update to 1.5.6
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder: common questions
Does User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder have known vulnerabilities?
Yes. VulnCrest Radar lists 73 known vulnerabilities in User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder: 4 critical, 11 high, 58 medium. None are known to affect version null.
How do I check which version of User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder vulnerability?
CVE-2026-124258, published Nov 7, 2026: User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.3.1 - Missing Authorization. Severity: Medium (CVSS 5.3).
Is any User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder vulnerability listed in CISA KEV?
No. None of the known User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder vulnerabilities is currently listed in the CISA KEV catalog.