The vulnerability allows an unauthenticated attacker to send a malicious HTTP Referer header that the User Registration PRO plugin stores without sanitization or escaping. When a user later visits any page that displays this header, the script is executed in the victim’s browser context. The vulnerability allows an unauthenticated attacker to send a malicious HTTP Referer header that the User Registration PRO plugin stores without sanitization or escaping. When a user later visits any page that displays this header, the script is executed in the victim’s browser context.

The issue affects the WPEverest User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin in all releases up to and including version 6.2.9. The free distribution is not affected. Only the premium build contains the vulnerable AJAX endpoint.

Because the vulnerable data path is available to all anonymous visitors and no additional authentication or restriction is required, the exploitation likelihood is moderate to high. The CVSS score of 7.2 indicates substantial impact, and while the EPSS score is not available, the absence from the KEV catalog does not preclude active exploitation. The simplest attack involves crafting a malicious Referer header and having an unauthenticated user access the affected page.