The vulnerability allows an unauthenticated attacker to send a malicious HTTP Referer header that the User Registration PRO plugin stores without sanitization or escaping. When a user later visits any page that displays this header, the script is executed in the victim’s browser context. The vulnerability allows an unauthenticated attacker to send a malicious HTTP Referer header that the User Registration PRO plugin stores without sanitization or escaping. When a user later visits any page that displays this header, the script is executed in the victim’s browser context.

The issue affects the WPEverest User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin in all releases up to and including version 6.2.9. The free distribution is not affected. Only the premium build contains the vulnerable AJAX endpoint.

Because the vulnerable data path is available to all anonymous visitors and no additional authentication or restriction is required, the potential for impact is high; however, the EPSS score of 0.0019 (<1%) indicates a very low likelihood of exploitation at present. The CVSS score of 7.2 reflects moderate to high impact if exploitation occurs. The absence from the KEV catalog does not preclude active exploitation. The simplest attack involves crafting a malicious Referer header and having an unauthenticated user access the affected page.