The vulnerability arises from improper neutralization of input during web page generation, allowing malicious user-controlled data to be reflected and executed by a victim’s browser. An attacker can inject script into the registration page, leading to theft of session cookies, credentials, and other sensitive information, or to perform unauthorized actions on behalf of the user. The issue is a classic reflected XSS flaw documented as CWE‑79.

WordPress User Registration plugin versions up through 5.1.5 are impacted. The plugin is distributed by wpeverest under the "User Registration" name; no additional products or platforms are listed as affected.

With a CVSS score of 7.1 the vulnerability is considered high severity, but it is not currently listed in the CISA KEV catalog and the EPSS score is unavailable. The attack requires a victim to visit or interact with the registration page, after which the attacker’s injected payload is executed in the victim’s browser. No advanced preconditions are identified beyond normal user access to the affected site.