The User Registration & Membership plugin for WordPress, developed by wpeverest, contains a stored cross-site scripting vulnerability (CWE-79) in its urcr_restrict shortcode. This vulnerability exists in all versions up to and including 4.2.4 due to inadequate sanitization and escaping of user-supplied attributes. Authenticated attackers with contributor-level privileges or higher can exploit this flaw to inject arbitrary JavaScript code that executes in the context of users visiting the compromised pages. The CVSS 3.1 base score is 6.4, reflecting a network attack vector with low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity with no impact on availability. No patch or official fix has been documented in the provided data.

Successful exploitation allows an authenticated user with contributor or higher privileges to inject and execute arbitrary scripts in the context of other users viewing the affected pages. This can lead to unauthorized actions, data disclosure, or session hijacking limited to the scope of the plugin's usage. The vulnerability does not affect availability. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or limiting use of the urcr_restrict shortcode to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.