CVE-2026-87111: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in WPEverest User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin

CVE-2026-87111 describes a stored cross-site scripting vulnerability in the premium build of the User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin. The flaw exists in all versions up to and including 6.2.9 due to improper neutralization of input from the HTTP Referer header. An unauthenticated attacker can inject arbitrary web scripts that execute in the context of users visiting the injected pages. The vulnerability is facilitated by a nonce for an AJAX endpoint that is embedded in every front-end page source, making it accessible to unauthenticated attackers. This vulnerability does not affect the free version of the plugin.

Successful exploitation allows an unauthenticated attacker to perform stored cross-site scripting attacks, potentially leading to the execution of arbitrary scripts in the context of users visiting the affected site. This can result in information disclosure or user session compromise. The CVSS 3.1 base score is 7.2 (high severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality and integrity but not availability.

No official patch or fix is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting use of the premium User Registration PRO plugin or applying web application firewall (WAF) rules to block malicious HTTP Referer headers. Monitor vendor channels for updates and apply official patches once released.