CVE-2025-30899: User Registration XSS Vulnerability

CVE-2025-30899 Overview

CVE-2025-30899 is a stored Cross-Site Scripting (XSS) vulnerability in the wpeverest User Registration & Membership plugin for WordPress. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. An authenticated attacker with high privileges can inject persistent JavaScript payloads that execute in the browsers of users who view affected pages. The vulnerability affects User Registration versions up to and including 4.0.3.

Critical Impact
A high-privilege authenticated attacker can store malicious scripts that execute in victim browsers, enabling session theft, redirection, and actions performed within the security context of the WordPress site.

Affected Products

wpeverest User Registration & Membership (Free) for WordPress — versions up to and including 4.0.3
wpeverest User Registration & Membership (Pro) for WordPress — versions up to and including 4.0.3
WordPress sites using the user-registration plugin below the patched release

Discovery Timeline

2025-03-27 - CVE-2025-30899 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-30899

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting flaw within the User Registration & Membership plugin developed by wpeverest. The plugin fails to sanitize or encode input that is later rendered inside a WordPress page or administrative view. Attacker-controlled markup is persisted server-side and returned to subsequent visitors as executable script.

Exploitation requires an authenticated actor with elevated privileges and some form of user interaction on the victim side. Because the scope changes when the payload executes, the impact reaches beyond the plugin boundary and affects other WordPress users rendering the injected content. Successful exploitation can lead to cookie theft, forced navigation, cross-site request forgery chained through the victim session, and further account takeover on WordPress sites that trust plugin-managed content.

Root Cause

The root cause is missing or insufficient output encoding of stored input rendered by the user-registration plugin. Input containing HTML or JavaScript is written to persistent storage and later emitted into web pages without contextual escaping, satisfying the conditions defined by [CWE-79].

Attack Vector

The attack vector is network-based. An authenticated attacker holding a privileged plugin role submits a payload containing script markup into a plugin-managed field. The payload is stored in the WordPress database and rendered to other users who navigate to affected pages, causing the browser to execute the attacker's JavaScript in the site's origin.

No verified public proof-of-concept code is available. See the Patchstack Advisory: XSS in User Registration Plugin for advisory-level technical details.

Detection Methods for CVE-2025-30899

Indicators of Compromise

Unexpected <script>, onerror, onload, or javascript: strings persisted in WordPress database tables associated with the user-registration plugin.
Outbound requests from administrator or member browsers to unknown domains immediately after loading registration or membership pages.
New or modified WordPress administrator accounts, API keys, or application passwords created shortly after a privileged user viewed a plugin page.

Detection Strategies

Review the installed version of the user-registration plugin across all WordPress sites and flag any instance at or below 4.0.3.
Search plugin-managed database rows and rendered HTML for script tags, event handler attributes, and encoded JavaScript payloads.
Correlate authenticated administrative sessions with anomalous DOM-initiated network traffic in web proxy or browser telemetry.

Monitoring Recommendations

Alert on modifications to WordPress user roles, options, and plugin configuration tables originating from unexpected sessions.
Monitor Content Security Policy violation reports for inline script execution on pages served by the user-registration plugin.
Track file integrity for wp-content/plugins/user-registration/ to detect tampering alongside stored payload activity.

How to Mitigate CVE-2025-30899

Immediate Actions Required

Upgrade the User Registration & Membership plugin to a release later than 4.0.3 on every WordPress site in the estate.
Audit privileged plugin users and rotate credentials for any account that could have injected stored content.
Inspect plugin-managed fields and database entries for script payloads and remove any malicious content before returning affected pages to production.

Patch Information

Update the user-registration plugin to a version above 4.0.3 as published by wpeverest. Consult the Patchstack Advisory: XSS in User Registration Plugin for the vendor-tracked fixed release and advisory metadata.

Workarounds

Restrict the plugin roles that can submit content to trusted administrators until the patched version is deployed.
Deploy a Content Security Policy that blocks inline scripts and restricts script sources on pages rendered by the plugin.
Place the WordPress site behind a web application firewall with rules that block XSS payloads targeting user-registration endpoints.

bash

# Configuration example: verify the installed plugin version via WP-CLI
wp plugin get user-registration --field=version
wp plugin update user-registration