Live › vulnerability › CVE-2026-27061
The User Registration WordPress plugin up to version 5.3.0 has a cross-site scripting flaw that a subscriber-level account can exploit. An attacker can plant script that runs in the browser of other users, such as administrators who view the injected content.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Sites running the User Registration plugin at version 5.3.0 or older are in the stated range. The attack needs a registered subscriber account on the site, so sites with open registration are the most exposed. Sites without this plugin or running a newer version are not affected.
No product ranges from the sources yet.
wp plugin get user-registration --field=version5.3.0)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-27061")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.