Live › vulnerability › CVE-2026-25467
The ThemeGrill User Registration WordPress plugin fails to neutralize script-related HTML tags in a page, which lets injected code run in the browser of whoever views it. An attacker can run scripts in a visitor's or administrator's session on the affected site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 14:25 UTC. All times on this page are UTC.
Sites running the User Registration plugin from ThemeGrill at version 5.3.0 or earlier. The flaw is a cross-site scripting issue, so exposure depends on whether user-supplied content is rendered back to other users, and the sources do not say which inputs or pages are involved.
No product ranges from the sources yet.
wp plugin get user-registration --field=version5.3.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ThemeGrill User Registration user-registration allows Code Injection.This issue affects User Registration: from n/a through 5.3.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-25467")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.