CVE-2025-39400 WordPress User Registration plugin < 4.2.0 - Reflected Cross Site Scripting (XSS) vulnerability

What is CVE-2025-39400?

CVE-2025-39400 is a high-severity cross-site scripting vulnerability in wpeverest User Registration, published on 24 Apr 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration user-registration allows Reflected XSS.This issue affects User Registration: from n/a through < 4.2.0.

Weakness: CWE-79

Which versions are affected by CVE-2025-39400?

It affects 1 product.

Products include Wpeverest User Registration \& Membership.

How do I fix CVE-2025-39400?

No fix has been published for CVE-2025-39400 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-39400 being exploited?

There is no known exploitation of CVE-2025-39400 in the wild and no public exploit code.

Other vulnerabilities in wpeverest User Registration

• CVE-2025-2594 User Registration & Membership < 4.1.3 - Authentication Bypass High 8.1
• CVE-2025-2563 User Registration & Membership < 4.1.2- Unauthenticated Privilege Escalation High 8.1
• CVE-2023-27459 WordPress User Registration plugin <= 2.3.2.1 - Authenticated PHP Object Injection vulnerability High 7.4
• CVE-2025-30899 WordPress User Registration plugin <= 4.0.3 - Cross Site Scripting (XSS) vulnerability Medium 5.9
• CVE-2025-3282 Missing authorization in User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f95c-548w-cjmj.