WordPress plugin
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 73 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical4
- High11
- Medium58
- Low0
All User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High8.1 | Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag ≤5.2.8Update to 5.3.0 | CVE-2026-92798 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value ≤5.2.8Update to 5.3.0 | CVE-2026-96660 | |
| High7.2 | Unauthenticated Open Redirect <5.2.8Update to 5.2.8 | CVE-2026-80072 | |
| High8.1 | Unauthenticated Privilege Escalation ≤5.2.2Update to 5.2.3 | CVE-2026-11961 | |
| Critical9.8 | Unauthenticated Remote Code Execution ≤4.4.9Update to 5.1.3 | CVE-2026-32488 | |
| Critical9.8 | Unauthenticated Privilege Escalation via Membership Registration ≤5.1.2Update to 5.1.3 | CVE-2026-1492 | |
| High8.1 | Authentication Bypass ≤5.1.2Update to 5.1.3 | CVE-2026-1779 | |
| High8.1 | Authentication Bypass ≤4.1.2Update to 4.1.3 | CVE-2025-2594 | |
| Critical9.8 | Unauthenticated Privilege Escalation ≤4.1.1Update to 4.1.2 | CVE-2025-2563 | |
| High7.1 | Missing Authorization to Privilege Escalation ≤3.2.0.1Update to 3.2.1 | CVE-2024-4958 | |
| High8.8 | Missing Authorization to Authenticated (Subscriber+) Privilege Escalation ≤3.1.5Update to 3.2.0 | CVE-2024-2417 | |
| Critical9.9 | Authenticated (Subscriber+) Arbitrary File Upload ≤3.0.2Update to 3.0.2.1 | CVE-2023-3342 | |
| High8.8 | Authenticated (Subscriber+) PHP Object Injection ≤3.0.1Update to 3.0.2 | CVE-2023-3343 | |
| High7.5 | PHP Object Injection ≤2.3.2.1Update to 2.3.3 | CVE-2023-27459 | |
| High8.8 | Authenticated (Subscriber+) Arbitrary File Upload ≤2.2.4Update to 2.2.41 | CVE-2022-3912 |
- High8.1Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag
≤5.2.8Update to 5.3.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value
≤5.2.8Update to 5.3.0
- High7.2Unauthenticated Open Redirect
<5.2.8Update to 5.2.8
- High8.1Unauthenticated Privilege Escalation
≤5.2.2Update to 5.2.3
- Critical9.8Unauthenticated Remote Code Execution
≤4.4.9Update to 5.1.3
- Critical9.8Unauthenticated Privilege Escalation via Membership Registration
≤5.1.2Update to 5.1.3
- High8.1Authentication Bypass
≤5.1.2Update to 5.1.3
- High8.1Authentication Bypass
≤4.1.2Update to 4.1.3
- Critical9.8Unauthenticated Privilege Escalation
≤4.1.1Update to 4.1.2
- High7.1Missing Authorization to Privilege Escalation
≤3.2.0.1Update to 3.2.1
- High8.8Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
≤3.1.5Update to 3.2.0
- Critical9.9Authenticated (Subscriber+) Arbitrary File Upload
≤3.0.2Update to 3.0.2.1
- High8.8Authenticated (Subscriber+) PHP Object Injection
≤3.0.1Update to 3.0.2
- High7.5PHP Object Injection
≤2.3.2.1Update to 2.3.3
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
≤2.2.4Update to 2.2.41
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder: common questions
Does User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder have known vulnerabilities?
Yes. VulnCrest Radar lists 73 known vulnerabilities in User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder: 4 critical, 11 high, 58 medium. None are known to affect version null.
How do I check which version of User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder vulnerability?
CVE-2026-124258, published Nov 7, 2026: User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.3.1 - Missing Authorization. Severity: Medium (CVSS 5.3).
Is any User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder vulnerability listed in CISA KEV?
No. None of the known User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder vulnerabilities is currently listed in the CISA KEV catalog.