The vulnerability lies in the urcr_restrict shortcode of the User Registration & Membership plugin, where insufficient input sanitization and output escaping allow an authenticated user with contributor-level access to inject arbitrary JavaScript that is stored and executed on any page containing the shortcode. This stored cross‑site scripting flaw (CWE‑79) can enable the attacker to run scripts in the context of site visitors, potentially stealing cookies, defacing content, or facilitating further malicious actions.

The affected vendor is wpEverest, and the entire User Registration & Membership plugin family is impacted for all WordPress sites running version 4.2.4 or earlier. Any installation of the plugin up to the specified version that uses the urcr_restrict shortcode is vulnerable.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% suggests a relatively low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exposition requires an authenticated contributor or higher account, and the attack vector involves inserting malicious code through the shortcode’s attributes, which is stored in the database and executed for every visitor that loads a page containing the shortcode.