Subscriber cross‑site scripting in the WordPress User Registration plugin enables attackers to inject malicious scripts that run in the browsers of users who view the affected registration interface. This can lead to session hijacking, credential theft, site defacement, or the delivery of phishing payloads. The flaw originates from unsanitized input in registration fields and is classified as CWE‑79.

The vulnerability impacts the WordPress User Registration plugin by WPEverest version 5.3.0 and earlier. All installations of these releases are affected until an update to 5.3.1 or newer is applied.

A CVSS score of 6.5 denotes moderate severity, yet no EPSS value indicates limited known exploitation. The plugin is not listed in the CISA KEV catalog, so no widespread attacks have been reported. Attackers can directly embed malicious payloads into the registration form, and any visitor who processes that input will execute the injected script. Thus, the primary attack vector is the web interface of an unpatched WordPress site, and the risk centers on XSS‑driven compromise of user data and brand reputation.