CVE-2021-24654: Wpeverest User Registration

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

The User Registration WordPress plugin before 2.0.2 does not properly sanitise the user_registration_profile_pic_url value when submitted directly via the user_registration_update_profile_details AJAX action. This could allow any authenticated user, such as subscriber, to perform Stored Cross-Site attacks when their profile is viewed

Affected products

• Wpeverest User Registration: before 2.0.2 (fixed in 2.0.2)

Published 2021-10-04. Last modified 2026-06-17.