The User Registration plugin allows script payloads to be stored in its form fields and later rendered in a page without proper sanitization, giving rise to a stored XSS flaw. This flaw features improper neutralization of input (CWE‑79). If an attacker injects malicious JavaScript that persists in a user‑supplied field, any visitor who views the affected page will have that payload executed in their browser. The resulting compromise could include session hijacking, credential theft, or execution of further malicious code inside the victim’s context.

This issue affects ThemeGrill’s WordPress User Registration plugin for all released versions up to and including 5.2.8. The plugin is commonly installed on WordPress sites that expose public registration or user‑profile management pages. Sites that run a newer version (5.3.0 and later) are not vulnerable.

The CVSS score of 6.5 indicates a moderate severity, and the EPSS score of less than 1 % suggests a very low current exploitation rate. The flaw is not listed in CISA’s KEV catalog. The most likely attack vector is through the plugin’s publicly exposed registration or user‑management interfaces, where an unauthenticated or authenticated user can submit JavaScript that is stored and subsequently rendered for other sites’ visitors. Because the vulnerability is stored, once a payload is saved the affected page repeatedly outputs the malicious code until it is removed.