CVE-2025-30899 WordPress User Registration plugin <= 4.0.3 - Cross Site Scripting (XSS) vulnerability

What is CVE-2025-30899?

CVE-2025-30899 is a medium-severity cross-site scripting vulnerability in wpeverest User Registration, published on 27 Mar 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through <= 4.0.3.

Weakness: CWE-79

Which versions are affected by CVE-2025-30899?

It affects 1 product.

Products include Wpeverest User Registration \& Membership.

How do I fix CVE-2025-30899?

No fix has been published for CVE-2025-30899 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-30899 being exploited?

There is no known exploitation of CVE-2025-30899 in the wild and no public exploit code.

Other vulnerabilities in wpeverest User Registration

• CVE-2025-2594 User Registration & Membership < 4.1.3 - Authentication Bypass High 8.1
• CVE-2025-2563 User Registration & Membership < 4.1.2- Unauthenticated Privilege Escalation High 8.1
• CVE-2023-27459 WordPress User Registration plugin <= 2.3.2.1 - Authenticated PHP Object Injection vulnerability High 7.4
• CVE-2025-39400 WordPress User Registration plugin < 4.2.0 - Reflected Cross Site Scripting (XSS) vulnerability High 7.1
• CVE-2025-3282 Missing authorization in User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m9v4-8vpr-cf66.