User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

Explore User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder vulnerabilities across all versions. Currently tracking 40 known vulnerabilities, including severity, impact, and patch status.

01234567891006.07.2017Today09.01.20196.4User Registration <= 1.5.5 - Cross-Site Scripting CVSS 6.4 · 09.01.201921.11.20228.8User Registration <= 2.2.4 - Authenticated (Subscriber+) Arbitrary File Upload CVSS 8.8 · 21.11.202220.01.20235.5User Registration <= 2.3.0 - Authenticated (Administrator+) Stored Cross Site Scripting CVSS 5.5 · 20.01.202321.03.20237.5User Registration <= 2.3.2.1 - PHP Object Injection CVSS 7.5 · 21.03.202306.04.20235.3User Registration <= 2.3.2.1 - Missing Authorization via send_test_email CVSS 5.3 · 06.04.202329.06.20238.8User Registration <= 3.0.1 - Authenticated (Subscriber+) PHP Object Injection CVSS 8.8 · 29.06.202304.07.20239.9User Registration <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Upload CVSS 9.9 · 04.07.202316.10.20234.4User Registration – Custom Registration Form, Login Form And User Profile For WordPress <= 3.0.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting CVSS 4.4 · 16.10.202306.03.20244.7User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.4 - Unauthenticated Stored Self-Based Cross-Site Scripting CVSS 4.7 · 06.03.202415.04.20246.5User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Unauthenticated Media Deletion CVSS 6.5 · 15.04.202419.04.20248.8User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation CVSS 8.8 · 19.04.202431.05.20247.1User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.2.0.1 - Missing Authorization to Privilege Escalation CVSS 7.1 · 31.05.202427.02.20256.1User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.0.4 - Reflected Cross-Site Scripting CVSS 6.1 · 27.02.202524.03.20259.8User Registration & Membership <= 4.1.1 - Unauthenticated Privilege Escalation CVSS 9.8 · 24.03.202527.03.20254.4User Registration <= 4.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 27.03.202501.04.20258.1User Registration & Membership <= 4.1.2 - Authentication Bypass CVSS 8.1 · 01.04.202511.04.20255.3User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Unauthenticated Membership Modification CVSS 5.3 · 11.04.20254.3User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Password Update CVSS 4.3 · 11.04.202522.04.20256.1User Registration <= 4.1.5 - Reflected Cross-Site Scripting CVSS 6.1 · 22.04.202505.05.20255.3User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.2.1 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion CVSS 5.3 · 05.05.202521.07.20256.4User Registration <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via urcr_restrict Shortcode CVSS 6.4 · 21.07.202505.09.20254.9User Registration & Membership <= 4.3.0 - Authenticated (Admin+) SQL Injection CVSS 4.9 · 05.09.202515.12.20256.4User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVSS 6.4 · 15.12.202508.01.20265.4User Registration <= 4.4.9 - Authenticated (Subscriber+) Arbitrary Shortcode Execution CVSS 5.4 · 08.01.202609.01.20265.4User Registration & Membership <= 4.4.8 - Cross-Site Request Forgery to Arbitrary Post Deletion CVSS 5.4 · 09.01.202621.01.20265.3User Registration <= 4.4.6 - Missing Authorization CVSS 5.3 · 21.01.202625.02.20265.3User Registration & Membership <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion CVSS 5.3 · 25.02.20268.1User Registration & Membership <= 5.1.2 - Authentication Bypass CVSS 8.1 · 25.02.202602.03.20269.8User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration CVSS 9.8 · 02.03.202623.03.20269.8User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 4.4.9 - Unauthenticated Remote Code Execution CVSS 9.8 · 23.03.20265.4User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation CVSS 5.4 · 23.03.202607.04.20266.5User Registration & Membership <= 5.1.2 - Authenticated (Subscriber+) SQL Injection via membership_ids[] CVSS 6.5 · 07.04.202609.04.20266.1User Registration <= 5.1.5 - Reflected Cross-Site Scripting CVSS 6.1 · 09.04.202613.04.20266.1User Registration & Membership <= 5.1.4 - Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter CVSS 6.1 · 13.04.202604.05.20264.3User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Limited Page Content Modification CVSS 4.3 · 04.05.202613.05.20265.3User Registration & Membership <= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter CVSS 5.3 · 13.05.202627.05.20265.3User Registration & Membership <= 5.1.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via 'profile-pic-url' Parameter CVSS 5.3 · 27.05.202628.05.20265.3User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.1.2 - Missing Authorization CVSS 5.3 · 28.05.202622.06.20265.3User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.2 - Missing Authorization CVSS 5.3 · 22.06.202625.06.20266.5User Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypass CVSS 6.5 · 25.06.2026

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage100%
Open

0

Fixed

40

Get automatic notifications for all User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder vulnerabilities before they are exploited.

Vulnerability Records

40 records
2026-06-25 19:44CVE-2026-1869
6.5
Medium
Supakiad S. (m3ez)Yes
2026-06-22 00:00CVE-2026-52701
5.3
Medium
nobody09Yes
2026-05-28 00:00CVE-2026-25425
5.3
Medium
0xd4rk5id3Yes
2026-05-27 00:00CVE-2026-7651
5.3
Medium
Supakiad S. (m3ez)Yes
2026-05-13 19:52CVE-2026-6145
5.3
Medium
Anthony Cihan (Hann1bl3L3ct3r)Yes
2026-05-04 19:57CVE-2026-3601
4.3
Medium
Hunter Jensen (skid)Yes
2026-04-13 09:51CVE-2026-6203
6.1
Medium
Louis Deschanel (JeanJeanLeHaxor)Yes
2026-04-09 00:00CVE-2026-42652
6.1
Medium
Raihan Adi ArbaYes
2026-04-07 23:11CVE-2026-1865
6.5
Medium
Athiwat Tiprasaharn (Jitlada)Yes
2026-03-23 11:24CVE-2026-4056
5.4
Medium
normaandersonfrankYes
Showing 1–10 of 40 reports
User Registration &amp; Membership &#8211; Free &amp; Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration &amp; Login Builder banner
Latestv5.2.6

User Registration &amp; Membership &#8211; Free &amp; Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration &amp; Login Builder

wpeverest

Author

wpeverest

4.8(827)
96/100
Last Updated
2026-07-23 (6d ago)
Active Installs
50,000+
Downloads
4,428,492
Requires WP
5.5+
Requires PHP
7.4+
Tested up to
WP 7.0.2
Created
2017-07-06 (9y ago)

Build membership sites with tiered plans, content restriction, drag-&-drop custom registration & login form builder, and built-in payment system. The Complete Membership Solution for WordPress Tired of juggling separate plugins for membership plans, user management, payment gateways, and user profile? User Registration & Membership (URM) helps you monetize your site by creating membership plans and accepting payments for gated content. Membership: Build membership plans, setup billing, and manage user access in a single connected flow. Custom User Registration Forms: Design custom registration form and for your users with drag-and-drop form builder. Payment Integration: Monetize your membership site with one-time fee, recurring subscription, and upgrade paths. Accept subscription payments through Stripe, PayPal, and bank transfer. Content Restriction: Restrict complete site, or individual pages and posts by membership subscription. 👉 Get Started Today 👉 Try Our Demo Complete Membership Solution Membership Groups and Plans: Create membership tiers with different access levels and benefits. Combine related plans into membership groups for organized front-end listing. Pre-Installed Membership Pages: Launch your membership site in minutes instead of hours with professional pages ready to use or customize: Registration, Login, My Account, Lost Password, Reset Password, Pricing, and Thank You pages. Content Restriction: Set restrictions globally, per page/post, or for specific content blocks within pages. Build complex access rules using membership plans, user roles, registration and login status. Membership Upgrade Path: Define clear upgrade paths between membership tiers and let users switch seamlessly without interrupting their access or membership status. Masteriyo Course Integration: Sell courses through memberships using our Masteriyo LMS integration. 10+ Membership Gutenberg Blocks: Create custom membership pages using our custom blocks: registration, my account, membership pricing, buy now block etc. Membership Analytics: Quickly glance over total registration, approved users, and pending requests with dedicated analytics dashboard. Custom User Registration Registration Form Builder: Build custom WordPress registration forms. Drag fields onto the canvas, arrange them visually, and configure settings with simple clicks. Login Form: Start with a pre-built login form and customize it to your needs. Choose form styles, configure login methods, add CAPTCHA, and set login/logout redirects. Live Form Preview: Preview registration and login forms in real-time to ensure everything looks and functions properly. Pre-built Form Templates: Save hours of setup time with professionally designed registration form templates. Use them as-is or customize fields and styling to match your specific needs. View All Form Templates Ajax Form Submission: Say goodbye to slow form submissions that reload the entire page. Users get instant confirmation or error messages. User Role Assignment: Assignment WordPress user roles (Administrator, Editor, Author, Contributor, Subscriber) to members during registration. Flexible Approval Method: Choose from auto-approval, email verification, and manual admin approval for new registration for quality control. Payment and Monetization Multiple Revenue Modules: Offer fixed-term memberships, recurring subscription or lifetime access. Trusted Payment Gateways: Accept secure payment with trusted global payment gateways even in the free version: PayPal Stripe Bank Transfer Payment History: Comprehensive transaction tracking with payment status, date, gateway, and more. complete history accessible to admins and members. User Registration & Membership PRO Features Membership and User Management Membership plans with tiered access control Admin approval for new registrations Member Directory with search filters searchable directories Role-based redirection after login Profile completeness indicator Advanced content restriction with complex rules User journey tracking Payment history tracking Social Connect (Facebook, Google, Twitter, LinkedIn login) Profile Connect (sync with other plugins) Block simultaneous logins Advanced Content Restriction Content drop for membership content URL-based restriction File download protection Conditional Content Restriction using AND, OR, and NOT logic. Registration Form Fields & Functionality 60+ form fields Conditional logic (show/hide fields based on user input) Multi-step forms with progress indicators Conversational forms (chat-like layout) Field visibility control Form restriction by custom rules Popup forms (modal display) Calculations Signature field Invite codes Repeater field (multiple entries per field group) Save and Continue (save partial progress) Monetization and Payment Processing Trial Period Multiple memberships per user Sell memberships to team Authorize.net Mollie integration Registration coupons and discounts Payment history dashboard Membership plan upgrades with pro-rated billing Discount coupon and codes Tax and EU VAT Sell in local currency Invoice generation Security & Spam Protection Email verification Google reCAPTCHA (V2, V3) hCaptcha Cloudflare Turnstile Akismet Honeypot spam protection SMS verification via Twilio Two-factor authentication (2FA) Auto-generated passwords Passwordless login Custom CAPTCHA field (math/Q&A) Whitelisted domains Design & Customization Email customizer Customize My Account page Style Customizer (visual form designer) Email Templates Advanced styling options for forms Analytics & Tracking Advanced analytics dashboard User journey tracking Advanced user/form analytics Dashboard with views, submissions, conversions Advanced Features PDF form submission (auto-generate PDFs) Frontend post submission Bulk user import (CSV) Invite codes for registration Geolocation data collection Private admin notes Form access by user role Cloud storage (Google Drive, Dropbox) Marketing and CRM Integrations Custom Email Notifications Mailchimp MailerLite MailPoet ActiveCampaign Klaviyo Brevo (formerly Sendinblue) Kit (formerly ConvertKit) Salesforce Zapier (5,000+ apps) Google Sheets Webhooks 👉 Get User Registration & Membership Pro Know your way around user registration with our tutorials How to Create a Membership Website in WordPress for Free (with Content Restriction) How to Create a Custom User Profile Page in WordPress? How to Create User Registration Form in WordPress Easily? How to Register Users with an Invitation Code in WordPress? How to Change Default WordPress Login URL to Custom URL? Get in Touch with us: Official Community | Twitter Important: Version 5.0 and above is a major update with significant improvements We strongly recommend backing up your site before updating. This update includes architectural changes that make your membership management more powerful and easier to use. Read the full blog post to see what’s new: User Registration & Membership v5.0

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C