The wpeverest User Registration plugin version 4.0.3 and earlier contains a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This allows an attacker with high privileges to inject malicious scripts that are stored and later executed when viewed by other users, potentially leading to limited compromise of confidentiality, integrity, and availability. The vulnerability is tracked as CVE-2025-30899 with a CVSS 3.1 base score of 5.9 (medium severity). No patch or vendor advisory is currently available, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker with high privileges to inject malicious scripts that execute in the context of other users, potentially leading to limited data disclosure, modification, or disruption of service. The impact is rated medium due to the requirement for high privileges and user interaction, and the limited scope of confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access and monitor for suspicious activity related to user input in the User Registration plugin. Avoid enabling untrusted users to submit input that could be stored and rendered without proper sanitization.