The vulnerability allows an attacker to inject arbitrary JavaScript that is later stored in the database. When a user loads a page that displays the checkbox value, the malicious script runs in the context of the site. The injection occurs because the plugin fails to sanitize the checkbox input or escape output. An unauthenticated user can target the AJAX endpoint, submit a crafted request, and the script is persisted. The result is that any visitor, including administrators, is exposed to phishing, credential theft, or site defacement.

WordPress sites running the User Registration & Membership plugin from wpeverest, versions up to and including 5.2.8, are affected. This includes both the free and paid variants. The vulnerable code resides in the AJAX handler class‑ur‑frontend‑form‑handler.php and is triggered by the user_registration_user_form_submit action. Any deployment that has the plugin installed and uses the default checkbox fields is at risk.

The CVSS score of 7.2 classifies the flaw as high. An attacker does not need credentials; the exposed AJAX endpoint accepts requests without a nonce. While EPSS is currently unavailable, the lack of authentication and the straightforward request structure suggest a non‑negligible exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog, yet its potential for widespread impact remains, especially on sites that allow public form submissions.