# User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

> Build membership sites with tiered plans, content restriction, drag-&-drop custom registration & login form builder, and built-in payment system.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 10:30 UTC.

## Facts (WordPress.org)

- Slug: `user-registration`
- Author: wpeverest
- Version: 5.3.2
- Active installs: 50,000+
- Last update: 2026-11-06 (7 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 5.5, PHP 7.4
- Tags: content restriction, membership, subscription, user profile, User Registration
- Page: https://wordpress.org/plugins/user-registration/

## Checks (against WordPress 7.1.4)

- OK: Updated 7 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Leaky ↔ Spam-proof, Breaking ↔ Smooth, Clashes ↔ Plays well, Slows pages ↔ Speeds up, Locked in ↔ Portable, Inaccessible ↔ Accessible.

## Known vulnerabilities

- 2026-11-07 MEDIUM: Missing Authorization (up to 5.3.1). CVE-2026-124258, https://www.wordfence.com/threat-intel/vulnerabilities/id/45f644d0-ec27-4090-9fb7-725df8cdd877?source=api-prod
- 2026-10-30 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting (up to 5.3.0). CVE-2026-27061, https://www.wordfence.com/threat-intel/vulnerabilities/id/e33f7ed0-739f-4a2b-8acb-8f7047dd75bc?source=api-prod
- 2026-10-29 MEDIUM: Missing Authorization (up to 5.3.0). CVE-2026-25450, https://www.wordfence.com/threat-intel/vulnerabilities/id/ee38b668-0b9c-4843-97e6-665531839249?source=api-prod
- 2026-10-17 HIGH: Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag (up to 5.2.8). CVE-2026-92798, https://www.wordfence.com/threat-intel/vulnerabilities/id/ec317df9-c7ef-49a3-9818-903dfe4bdd03?source=api-prod
- 2026-10-17 MEDIUM: Cross-Site Request Forgery to trigger_bulk_action() (up to 5.2.8). CVE-2026-92978, https://www.wordfence.com/threat-intel/vulnerabilities/id/713c4652-9ca0-41f7-9a93-8186d9b359e8?source=api-prod
- 2026-10-17 HIGH: Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value (up to 5.2.8). CVE-2026-96660, https://www.wordfence.com/threat-intel/vulnerabilities/id/690d23ee-cf70-4ecf-8cd2-21f673788d5f?source=api-prod
- 2026-10-16 MEDIUM: Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name (up to 5.2.8). CVE-2026-15222, https://www.wordfence.com/threat-intel/vulnerabilities/id/f61873db-7365-41cb-a774-8f455a963d78?source=api-prod
- 2026-10-15 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting (up to 5.2.8). CVE-2026-105882, https://www.wordfence.com/threat-intel/vulnerabilities/id/8642657a-08a1-44eb-8c83-90307769d604?source=api-prod
- 2026-10-15 MEDIUM: Missing Authorization (up to 5.2.8). CVE-2026-109692, https://www.wordfence.com/threat-intel/vulnerabilities/id/e2aad18b-14e4-49bd-b212-d9cbd0f57999?source=api-prod
- 2026-10-13 MEDIUM: Cross-Site Request Forgery (up to 5.2.8). CVE-2026-103076, https://www.wordfence.com/threat-intel/vulnerabilities/id/d8e6ebf2-a1b6-45c3-82d0-b94808e90741?source=api-prod
- 2026-10-13 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 5.2.8). CVE-2026-105881, https://www.wordfence.com/threat-intel/vulnerabilities/id/e4d22382-11c4-4e2b-9bfd-6bef5c5ff246?source=api-prod
- 2026-10-13 MEDIUM: Missing Authorization (up to 5.2.8). CVE-2026-106597, https://www.wordfence.com/threat-intel/vulnerabilities/id/152b63ce-7047-4cd2-beec-d640becd48e4?source=api-prod
- 2026-10-13 MEDIUM: Unauthenticated Information Exposure (up to 5.2.8). CVE-2026-106598, https://www.wordfence.com/threat-intel/vulnerabilities/id/3c830ec2-3b09-448b-b535-b17baf35304c?source=api-prod
- 2026-10-13 MEDIUM: Missing Authorization (up to 5.2.8). CVE-2026-109699, https://www.wordfence.com/threat-intel/vulnerabilities/id/50a451e5-f96c-477f-b0af-162522278247?source=api-prod
- 2026-10-09 MEDIUM: Missing Authorization (up to 5.2.7). CVE-2026-96334, https://www.wordfence.com/threat-intel/vulnerabilities/id/55e6291d-4431-4eba-ad7d-fe96060ebcde?source=api-prod
- 2026-09-17 MEDIUM: Missing Authorization (up to 5.2.7). CVE-2026-74017, https://www.wordfence.com/threat-intel/vulnerabilities/id/dbf13a06-0e2e-441a-9732-31c7e8997aeb?source=api-prod
- 2026-09-13 MEDIUM: Authenticated (Author+) Privilege Escalation (before 5.2.8). CVE-2026-80071, https://www.wordfence.com/threat-intel/vulnerabilities/id/216f1faf-362a-4218-93f1-9f1f4ad171aa?source=api-prod
- 2026-09-13 HIGH: Unauthenticated Open Redirect (before 5.2.8). CVE-2026-80072, https://www.wordfence.com/threat-intel/vulnerabilities/id/ba40115a-4a77-4b71-8f76-734e8db90d1b?source=api-prod
- 2026-09-13 MEDIUM: Authenticated (Subscriber+) Privilege Escalation (4.4.6 to 5.2.7). CVE-2026-86406, https://www.wordfence.com/threat-intel/vulnerabilities/id/ae8c1d8e-8a87-4dd8-b7f5-c6655d3f6451?source=api-prod
- 2026-09-13 MEDIUM: Unauthenticated Information Exposure (5.0 to 5.2.7). CVE-2026-86407, https://www.wordfence.com/threat-intel/vulnerabilities/id/ccbf971e-9181-4a0c-88a4-efe8634c7b5c?source=api-prod
- 2026-08-28 MEDIUM: Authenticated (Subscriber+) Insecure Direct Object Reference (before 5.2.5). CVE-2026-79995, https://www.wordfence.com/threat-intel/vulnerabilities/id/6e2f8f97-0f45-4d04-b6ef-77b562d07662?source=api-prod
- 2026-08-28 MEDIUM: Authenticated (Custom Role+) Privilege Escalation (before 5.2.6). CVE-2026-79996, https://www.wordfence.com/threat-intel/vulnerabilities/id/fdb276aa-785f-4655-8843-29e82b0ad92c?source=api-prod
- 2026-08-18 MEDIUM: Missing Authorization (up to 5.2.6). CVE-2026-73995, https://www.wordfence.com/threat-intel/vulnerabilities/id/37f6e19c-2e24-4a25-890f-60ebf7fdc2ae?source=api-prod
- 2026-08-13 MEDIUM: Missing Authorization (up to 5.2.6). CVE-2026-73403, https://www.wordfence.com/threat-intel/vulnerabilities/id/cbcec789-62b1-4858-a746-8034ff988458?source=api-prod
- 2026-08-05 MEDIUM: Missing Authorization to Unauthenticated Account Creation While Registration Disabled (up to 5.2.5). CVE-2026-16736, https://www.wordfence.com/threat-intel/vulnerabilities/id/69cb9ffe-891d-44dc-b600-f5ebc941ab47?source=api-prod
- 2026-07-17 HIGH: Unauthenticated Privilege Escalation (up to 5.2.2). CVE-2026-11961, https://www.wordfence.com/threat-intel/vulnerabilities/id/fe3522ff-3eed-4b6a-910a-509b8963e992?source=api-prod
- 2026-07-17 MEDIUM: Missing Authorization to Unauthenticated User Deletion via Stripe Handler (up to 5.2.2). CVE-2026-11966, https://www.wordfence.com/threat-intel/vulnerabilities/id/69347507-b9fe-4334-a428-e874173ddbb8?source=api-prod
- 2026-07-13 MEDIUM: Authenticated (Subscriber+) Insecure Direct Object Reference to Membership Tier Modification (up to 5.2.1). CVE-2026-11963, https://www.wordfence.com/threat-intel/vulnerabilities/id/f36b3571-1dc1-4c2f-8888-5fd823ce1954?source=api-prod
- 2026-07-13 MEDIUM: Unauthenticated PayPal Bypass to Membership Activation (up to 5.2.1). CVE-2026-11964, https://www.wordfence.com/threat-intel/vulnerabilities/id/cfa6bc4b-7fc8-40c7-bfca-18410f6cd615?source=api-prod
- 2026-07-02 MEDIUM: Unauthenticated Payment Bypass (up to 5.1.0). CVE-2026-11965, https://www.wordfence.com/threat-intel/vulnerabilities/id/4c7b4361-75ac-4f09-9f69-afb5898cff0c?source=api-prod
- 2026-06-26 MEDIUM: Missing Authorization (up to 5.2.2). CVE-2026-52701, https://www.wordfence.com/threat-intel/vulnerabilities/id/248e8bb0-a9d4-4bc8-90bf-d568f15b7d34?source=api-prod
- 2026-06-26 MEDIUM: Missing Authorization to Unauthenticated Payment Bypass (up to 5.2.0). CVE-2026-1869, https://www.wordfence.com/threat-intel/vulnerabilities/id/9bf5b60b-5a4f-4227-97ac-a952019f46d9?source=api-prod
- 2026-06-15 MEDIUM: Missing Authorization (up to 5.1.2). CVE-2026-25425, https://www.wordfence.com/threat-intel/vulnerabilities/id/4609e1a8-c766-4054-a5d0-eabff1089300?source=api-prod
- 2026-05-28 MEDIUM: Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via 'profile-pic-url' Parameter (up to 5.1.5). CVE-2026-7651, https://www.wordfence.com/threat-intel/vulnerabilities/id/0def7637-edf4-4ae2-a2e7-31ccb3b52d71?source=api-prod
- 2026-05-14 MEDIUM: Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter (up to 5.1.5). CVE-2026-6145, https://www.wordfence.com/threat-intel/vulnerabilities/id/b6b349f2-24c9-4921-bb5f-a7726ebc5c2a?source=api-prod
- 2026-05-05 MEDIUM: Missing Authorization to Authenticated (Contributor+) Limited Page Content Modification (up to 5.1.4). CVE-2026-3601, https://www.wordfence.com/threat-intel/vulnerabilities/id/c8798fb2-4cab-4960-9e32-fd74bb4a5091?source=api-prod
- 2026-04-29 MEDIUM: Reflected Cross-Site Scripting (up to 5.1.5). CVE-2026-42652, https://www.wordfence.com/threat-intel/vulnerabilities/id/e15441f3-3ffe-4466-9119-e5354fd1c1c4?source=api-prod
- 2026-04-13 MEDIUM: Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter (up to 5.1.4). CVE-2026-6203, https://www.wordfence.com/threat-intel/vulnerabilities/id/020bed37-9544-49b7-941d-3b7f509fdfdf?source=api-prod
- 2026-04-07 MEDIUM: Authenticated (Subscriber+) SQL Injection via membership_ids[] (up to 5.1.2). CVE-2026-1865, https://www.wordfence.com/threat-intel/vulnerabilities/id/07c79459-66b8-4c93-a1cd-6e3ede95643f?source=api-prod
- 2026-03-23 CRITICAL: Unauthenticated Remote Code Execution (up to 4.4.9). CVE-2026-32488, https://www.wordfence.com/threat-intel/vulnerabilities/id/37e1a755-7c17-4cb4-acca-9f26238230f3?source=api-prod
- 2026-03-23 MEDIUM: Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation (up to 5.1.4). CVE-2026-4056, https://www.wordfence.com/threat-intel/vulnerabilities/id/7bb5a5a2-9644-4850-a5f9-7c925af000c8?source=api-prod
- 2026-03-02 CRITICAL: Unauthenticated Privilege Escalation via Membership Registration (up to 5.1.2). CVE-2026-1492, https://www.wordfence.com/threat-intel/vulnerabilities/id/7e9fec92-f471-4ce9-9138-1c58ad658da2?source=api-prod
- 2026-02-25 MEDIUM: Insecure Direct Object Reference to Unauthenticated Limited User Deletion (up to 5.1.2). CVE-2026-2356, https://www.wordfence.com/threat-intel/vulnerabilities/id/a5a1ccb2-4f78-4855-a01d-b15f73407822?source=api-prod
- 2026-02-25 HIGH: Authentication Bypass (up to 5.1.2). CVE-2026-1779, https://www.wordfence.com/threat-intel/vulnerabilities/id/d99bc021-ba9e-4294-8dd2-c25bc8007d05?source=api-prod
- 2026-01-21 MEDIUM: Missing Authorization (up to 4.4.6). CVE-2025-67956, https://www.wordfence.com/threat-intel/vulnerabilities/id/6193139b-52bf-425c-b1d3-c6fbd9185f06?source=api-prod
- 2026-01-09 MEDIUM: Cross-Site Request Forgery to Arbitrary Post Deletion (up to 4.4.8). CVE-2025-14976, https://www.wordfence.com/threat-intel/vulnerabilities/id/e5495b4c-a1ac-4860-83a7-686d9436d983?source=api-prod
- 2026-01-08 MEDIUM: Authenticated (Subscriber+) Arbitrary Shortcode Execution (up to 4.4.9). CVE-2026-24353, https://www.wordfence.com/threat-intel/vulnerabilities/id/cd4c2c11-2d73-48b4-8e7e-e281451973a2?source=api-prod
- 2025-12-15 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (up to 4.4.6). CVE-2025-13367, https://www.wordfence.com/threat-intel/vulnerabilities/id/2244945a-5b3a-463d-9910-46a6f7afaf6c?source=api-prod
- 2025-09-05 MEDIUM: Authenticated (Admin+) SQL Injection (up to 4.3.0). CVE-2025-9085, https://www.wordfence.com/threat-intel/vulnerabilities/id/ba326241-46a3-4891-a180-d7977f4e83ed?source=api-prod
- 2025-07-21 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via urcr_restrict Shortcode (up to 4.2.4). CVE-2025-6831, https://www.wordfence.com/threat-intel/vulnerabilities/id/50f3e469-f788-45da-95e7-aa6da1e87fd1?source=api-prod
- 2025-05-05 MEDIUM: Insecure Direct Object Reference to Unauthenticated Limited User Deletion (up to 4.2.1). CVE-2025-3281, https://www.wordfence.com/threat-intel/vulnerabilities/id/30339ff6-b6bf-4c56-b6cd-db0b8a6ce8b6?source=api-prod
- 2025-04-22 MEDIUM: Reflected Cross-Site Scripting (up to 4.1.5). CVE-2025-39400, https://www.wordfence.com/threat-intel/vulnerabilities/id/98345631-45df-419b-aada-b7053a31b68c?source=api-prod
- 2025-04-11 MEDIUM: Insecure Direct Object Reference to Authenticated (Subscriber+) User Password Update (up to 4.1.3). CVE-2025-3292, https://www.wordfence.com/threat-intel/vulnerabilities/id/59a63cd8-9d33-4a2c-a499-5b1ee38c07d6?source=api-prod
- 2025-04-11 MEDIUM: Insecure Direct Object Reference to Unauthenticated Membership Modification (up to 4.1.3). CVE-2025-3282, https://www.wordfence.com/threat-intel/vulnerabilities/id/c525b41c-dca5-442a-927e-4583cb303ed1?source=api-prod
- 2025-04-01 HIGH: Authentication Bypass (up to 4.1.2). CVE-2025-2594, https://www.wordfence.com/threat-intel/vulnerabilities/id/a4149783-ffa3-4efd-af55-5aa1c0e44443?source=api-prod
- 2025-03-27 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting (up to 4.0.3). CVE-2025-30899, https://www.wordfence.com/threat-intel/vulnerabilities/id/ea59d04e-b332-49f8-bf3f-6e0cda3be712?source=api-prod
- 2025-03-24 CRITICAL: Unauthenticated Privilege Escalation (up to 4.1.1). CVE-2025-2563, https://www.wordfence.com/threat-intel/vulnerabilities/id/ffd9cbd1-f8a9-401e-8cdd-1ff16f438b4a?source=api-prod
- 2025-02-27 MEDIUM: Reflected Cross-Site Scripting (up to 4.0.4). CVE-2025-1511, https://www.wordfence.com/threat-intel/vulnerabilities/id/0e0bee7c-8dce-421c-af16-7e5152797e6c?source=api-prod
- 2024-05-31 HIGH: Missing Authorization to Privilege Escalation (up to 3.2.0.1). CVE-2024-4958, https://www.wordfence.com/threat-intel/vulnerabilities/id/710574a8-a6e2-4ee6-9ea7-03a34994fec7?source=api-prod
- 2024-04-19 HIGH: Missing Authorization to Authenticated (Subscriber+) Privilege Escalation (up to 3.1.5). CVE-2024-2417, https://www.wordfence.com/threat-intel/vulnerabilities/id/d03459d8-b1f2-4270-a294-403754db1f2f?source=api-prod
- 2024-04-15 MEDIUM: Missing Authorization to Unauthenticated Media Deletion (up to 3.1.5). CVE-2024-3295, https://www.wordfence.com/threat-intel/vulnerabilities/id/864a3444-0479-4b9f-beca-584a4a9b8682?source=api-prod
- 2024-03-06 MEDIUM: Unauthenticated Stored Self-Based Cross-Site Scripting (up to 3.1.4). CVE-2024-1720, https://www.wordfence.com/threat-intel/vulnerabilities/id/62b809dc-4089-4822-8aeb-7049fcfe376e?source=api-prod
- 2023-10-16 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting (up to 3.0.4.1). CVE-2023-5228, https://www.wordfence.com/threat-intel/vulnerabilities/id/1b70b9b1-bde9-4a32-ae7b-a4c8d73abbc4?source=api-prod
- 2023-07-04 CRITICAL: Authenticated (Subscriber+) Arbitrary File Upload (up to 3.0.2). CVE-2023-3342, https://www.wordfence.com/threat-intel/vulnerabilities/id/a979e885-f7dd-4616-a881-64f3d97c309d?source=api-prod
- 2023-06-29 HIGH: Authenticated (Subscriber+) PHP Object Injection (up to 3.0.1). CVE-2023-3343, https://www.wordfence.com/threat-intel/vulnerabilities/id/3590277a-3319-4707-b728-d75ea59e8ad9?source=api-prod
- 2023-04-06 MEDIUM: Missing Authorization via send_test_email (up to 2.3.2.1). CVE-2023-29429, https://www.wordfence.com/threat-intel/vulnerabilities/id/a671128a-74e6-4f92-94af-9e5e37ed7b7a?source=api-prod
- 2023-03-21 HIGH: PHP Object Injection (up to 2.3.2.1). CVE-2023-27459, https://www.wordfence.com/threat-intel/vulnerabilities/id/5835fed0-5b9d-47b5-82ae-f0f19830ae2a?source=api-prod
- 2023-01-20 MEDIUM: Authenticated (Administrator+) Stored Cross Site Scripting (up to 2.3.0). CVE-2023-23987, https://www.wordfence.com/threat-intel/vulnerabilities/id/26529849-c52c-40e5-8085-6764c22a03e7?source=api-prod
- 2022-11-21 HIGH: Authenticated (Subscriber+) Arbitrary File Upload (up to 2.2.4). CVE-2022-3912, https://www.wordfence.com/threat-intel/vulnerabilities/id/c07ea205-5a05-43f5-993e-c6e30f660ac8?source=api-prod
- 2019-01-09 MEDIUM: Cross-Site Scripting (up to 1.5.5). WF-761a4801-fc4a-40a0-b5aa-303d88a87062, https://www.wordfence.com/threat-intel/vulnerabilities/id/761a4801-fc4a-40a0-b5aa-303d88a87062?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=user-registration · HTML: https://todaywp.com/plugins/user-registration