CVE-2026-96660: WordPress User Registration Plugin XSS Flaw

CVE-2026-96660 Overview

CVE-2026-96660 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the WordPress User Registration & Membership plugin. The flaw affects all versions up to and including 5.2.8. Unauthenticated attackers can inject arbitrary JavaScript through the Checkbox Field Value because the plugin fails to sanitize input and escape output. The injected script executes in the browser of any user who views an affected page.

The vulnerable code path is reachable through the nopriv AJAX action user_registration_user_form_submit, which calls ur_process_registration() without nonce validation. This allows any unauthenticated HTTP request to reach the sink.

Critical Impact
Unauthenticated attackers can store persistent JavaScript payloads that execute against site visitors and administrators, enabling session theft, account takeover, and administrative action hijacking.

Affected Products

WordPress User Registration & Membership plugin — all versions up to and including 5.2.8
Sites using the plugin's Checkbox field type in registration forms
WordPress installations exposing the user_registration_user_form_submit AJAX endpoint

Discovery Timeline

2026-10-17 - CVE-2026-96660 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-96660

Vulnerability Analysis

The vulnerability resides in the Checkbox Field Value handling path of the User Registration & Membership plugin. The plugin exposes the AJAX action user_registration_user_form_submit to unauthenticated users through the wp_ajax_nopriv_* hook. This handler invokes ur_process_registration() without verifying a nonce or any form of request authenticity.

Submitted field values flow from the AJAX handler in class-ur-ajax.php into the form processor in class-ur-frontend-form-handler.php, then into the core helpers in functions-ur-core.php and template rendering in functions-ur-template.php. Checkbox field values are stored in user meta without sufficient sanitization and later rendered to the page without proper output escaping.

The result is a persistent XSS payload stored server-side that executes in the browser context of any user who views the rendered output. See the Wordfence Vulnerability Analysis for additional technical detail.

Root Cause

The root cause is twofold. First, the plugin registers a nopriv AJAX handler that reaches sensitive registration logic without CSRF nonce validation. Second, the Checkbox Field Value is neither sanitized on input nor escaped on output, violating the WordPress Plugin Handbook guidance on sanitize_text_field() and esc_html() / esc_attr() usage.

Attack Vector

An unauthenticated attacker sends a crafted POST request to admin-ajax.php invoking the user_registration_user_form_submit action. The request includes a checkbox field value containing a JavaScript payload. The plugin stores the payload and renders it unescaped in pages that display the submitted data, triggering script execution in the viewer's browser session.

Technical details on the vulnerable code paths are documented in the WordPress User Registration AJAX Handler and the WordPress User Registration Form Handler source references.

Detection Methods for CVE-2026-96660

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php with action=user_registration_user_form_submit originating from unauthenticated sources
Checkbox field payloads containing HTML tags, <script>, javascript:, event handlers such as onerror= or onclick=, or encoded script fragments
Unexpected JavaScript executing on pages that render user registration fields
New or modified user meta entries containing HTML or script content tied to checkbox fields

Detection Strategies

Inspect web server access logs for high-volume or anomalous requests targeting the user_registration_user_form_submit AJAX action
Scan wp_usermeta entries associated with the plugin's checkbox fields for HTML or scripting characters
Deploy Web Application Firewall (WAF) rules that flag registration submissions containing script-like content

Monitoring Recommendations

Alert on unauthenticated hits to admin-ajax.php with the vulnerable action parameter
Monitor outbound requests from admin browser sessions for calls to unexpected external domains, which may indicate payload callbacks
Track creation of new administrator accounts or privilege changes immediately following registration activity

How to Mitigate CVE-2026-96660

Immediate Actions Required

Update the User Registration & Membership plugin to a version later than 5.2.8 that includes the fix from Changeset 3741339
Audit existing user registration data for stored payloads and purge malicious content from user meta
Review administrator accounts for unauthorized additions or privilege changes
Rotate credentials and invalidate active sessions for administrative users

Patch Information

The vendor addressed the vulnerability in the plugin repository via Changeset 3741339, which modifies class-ur-frontend-form-handler.php to properly handle Checkbox Field Value input. Site operators should upgrade to the latest release of the plugin from the WordPress plugin directory.

Workarounds

Disable the User Registration & Membership plugin until it can be updated
Remove or restrict Checkbox fields from active registration forms
Deploy WAF rules to block POST requests to admin-ajax.php carrying the user_registration_user_form_submit action with script-like payloads
Restrict unauthenticated access to admin-ajax.php at the reverse proxy where feasible

bash

# Example WAF rule concept to block script-like payloads in the vulnerable action
# (adapt to your WAF syntax)
SecRule ARGS:action "@streq user_registration_user_form_submit" \
  "id:1026966600,phase:2,deny,status:403,\
   chain,msg:'Block CVE-2026-96660 XSS attempt'"
  SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:none,t:urlDecodeUni"