Introduction
Persistent JavaScript injection can compromise user accounts, steal credentials, and give attackers long-term access to a WordPress site. The Simple User Registration plugin for WordPress manages user signups and membership workflows, and it was found to contain a high-severity stored cross-site scripting flaw that unauthenticated users could exploit. This brief summary covers the technical root cause, the affected versions, and the patch for CVE-2025-12160.
The Simple User Registration plugin is a user management extension for WordPress with around 300 active installations as of mid-2025. It is not among the largest plugins in the ecosystem, but membership and community sites rely on it to handle user onboarding and profile management.
Technical Information
CVE-2025-12160 is a stored cross-site scripting vulnerability in the Simple User Registration plugin for WordPress, present in all versions up to and including 6.6. It lies in the handling of the wpr_admin_msg parameter, which the plugin's admin messaging functionality uses. Because the plugin does not sufficiently sanitize input and does not escape output, an attacker can submit a crafted payload containing JavaScript through this parameter. The payload is stored in the WordPress database and rendered as executable code whenever a user opens a page that displays the injected message.
The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). Exploiting it requires no authentication. An injected script runs in the context of any user who views the affected page, administrators included, and that can lead to session hijacking, privilege escalation, or further compromise of the site. The root cause is that the plugin does not properly validate input or escape output when it processes the wpr_admin_msg parameter.
Version 6.7 fully fixes the issue. It adds input sanitization and output escaping, and it restricts unauthenticated access to the admin messaging functionality.
Affected Systems and Versions
All versions of the Simple User Registration plugin for WordPress up to and including 6.6 are affected. A site running one of these versions is vulnerable if the plugin is active and the admin messaging feature is exposed.
Vendor Security History
Recent versions of the Simple User Registration plugin include several security updates, among them fixes for CSRF and XSS vulnerabilities. The vendor released version 6.7 promptly after CVE-2025-12160 was disclosed, and that release fixes the root cause by improving input handling and access controls. Earlier changelogs indicate a pattern of reactive security work, with improvements following public reports of vulnerabilities.
