User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 47% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A declining trend compresses what a buyer would pay.

Recent releases and news for this plugin

1. — Version 5.2.6 Enhance – Compatibility with divi 5. Enhance – Allow 100% discount coupons on memberships. Enhance – Redirect hint links to Enable Custom Redirect setting. Fix – Local currency bugs. Fix – Double Charge on Upgrade. Fix – 5.2.6
2. — Version 5.2.5 Enhance – Defer expiry to period end. Enhance – Pin Stripe subscription payment method for reliable renewals. Fix – User and admin email order. Fix – Payment fail case for paypal. Fix – Lost Password Carrot adjustment. F 5.2.5
3. — Version 5.2.4 Enhance – User role overwritten on new membership assignment. Enhance – Add customizable membership registration success message in settings. Fix – Duplicate variable. Fix – Invoice dynamic content not translatable. Fix 5.2.4
4. — Version 5.2.3 Fix – validation for receiver email and payment amount in PayPal IPN handling. Fix – Selected membership tier during registration missed proper validation, allowing assignment of off-form membership tiers. Fix – Stripe s 5.2.3
5. — Version 5.2.2 Dev – Add UR_WPML compatibility service class. Fix – Password reset link shows “invalid or expired” error. Fix – Membership subscriptions stuck pending on 3D Secure (SCA) cards. Fix – Hardcoded database table names causi 5.2.2
6. — Version 5.2.1 Fix – Stripe order validation issue. Fix – Membership upgrade action not available after disabling group add-on. Fix – Custom emails addon cannot be enabled with plus plan even available in personal. Fix – Nav menu items 5.2.1

48 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 4.3 User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.6 - Missing Authorization ↗
   2026-08-14 CVE-2026-73995 Missing Authorization Affects <= 5.2.6 Patched in 5.2.7
2. Medium · 5.3 User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.6 - Missing Authorization ↗
   2026-08-13 CVE-2026-73403 Missing Authorization Affects <= 5.2.6 Patched in 5.2.7
3. Medium · 5.3 User Registration & Membership <= 5.2.5 - Missing Authorization to Unauthenticated Account Creation While Registration Disabled ↗
   2026-07-27 CVE-2026-16736 Missing Authorization Affects <= 5.2.5 Patched in 5.2.6
4. Medium · 5.3 User Registration & Membership <= 5.2.2 - Missing Authorization to Unauthenticated User Deletion via Stripe Handler ↗
   2026-06-26 CVE-2026-11966 Authorization Bypass Through User-Controlled Key Affects <= 5.2.2 Patched in 5.2.3
5. High · 8.1 User Registration & Membership <= 5.2.2 - Unauthenticated Privilege Escalation ↗
   2026-06-26 CVE-2026-11961 Improper Privilege Management Affects <= 5.2.2 Patched in 5.2.3
6. Medium · 6.5 User Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypass ↗
   2026-06-25 CVE-2026-1869 Missing Authorization Affects <= 5.2.0 Patched in 5.2.1
7. Medium · 5.3 User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.2 - Missing Authorization ↗
   2026-06-22 CVE-2026-52701 Missing Authorization Affects <= 5.2.2 Patched in 5.2.3
8. Medium · 5.3 User Registration & Membership <= 5.2.1 - Unauthenticated PayPal Bypass to Membership Activation ↗
   2026-06-22 CVE-2026-11964 Improper Authentication Affects <= 5.2.1 Patched in 5.2.2
9. Medium · 4.3 User Registration & Membership <= 5.2.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Membership Tier Modification ↗
   2026-06-22 CVE-2026-11963 Authorization Bypass Through User-Controlled Key Affects <= 5.2.1 Patched in 5.2.2
10. Medium · 5.3 User Registration & Membership <= 5.1.0 - Unauthenticated Payment Bypass ↗
    2026-06-11 CVE-2026-11965 Client-Side Enforcement of Server-Side Security Affects <= 5.1.0 Patched in 5.2.0
11. Medium · 5.3 User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.1.2 - Missing Authorization ↗
    2026-05-28 CVE-2026-25425 Missing Authorization Affects <= 5.1.2 Patched in 5.1.3
12. Medium · 5.3 User Registration & Membership <= 5.1.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via 'profile-pic-url' Parameter ↗
    2026-05-27 CVE-2026-7651 Authorization Bypass Through User-Controlled Key Affects <= 5.1.5 Patched in 5.1.6
13. Medium · 5.3 User Registration & Membership <= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter ↗
    2026-05-13 CVE-2026-6145 Missing Authorization Affects <= 5.1.5 Patched in 5.1.6
14. Medium · 4.3 User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Limited Page Content Modification ↗
    2026-05-04 CVE-2026-3601 Missing Authorization Affects <= 5.1.4 Patched in 5.1.5
15. Medium · 6.1 User Registration & Membership <= 5.1.4 - Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter ↗
    2026-04-13 CVE-2026-6203 URL Redirection to Untrusted Site ('Open Redirect') Affects <= 5.1.4 Patched in 5.1.5
16. Medium · 6.1 User Registration <= 5.1.5 - Reflected Cross-Site Scripting ↗
    2026-04-09 CVE-2026-42652 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.1.5 Patched in 5.1.6
17. Medium · 6.5 User Registration & Membership <= 5.1.2 - Authenticated (Subscriber+) SQL Injection via membership_ids[] ↗
    2026-04-07 CVE-2026-1865 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 5.1.2 Patched in 5.1.3
18. Medium · 5.4 User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation ↗
    2026-03-23 CVE-2026-4056 Missing Authorization Affects <= 5.1.4 Patched in 5.1.5
19. Critical · 9.8 User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 4.4.9 - Unauthenticated Remote Code Execution ↗
    2026-03-23 CVE-2026-32488 Incorrect Privilege Assignment Affects <= 4.4.9 Patched in 5.1.3
20. Critical · 9.8 User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration ↗
    2026-03-02 CVE-2026-1492 Improper Privilege Management Affects <= 5.1.2 Patched in 5.1.3
21. Medium · 5.3 User Registration & Membership <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion ↗
    2026-02-25 CVE-2026-2356 Improper Access Control Affects <= 5.1.2 Patched in 5.1.3
22. High · 8.1 User Registration & Membership <= 5.1.2 - Authentication Bypass ↗
    2026-02-25 CVE-2026-1779 Authentication Bypass Using an Alternate Path or Channel Affects <= 5.1.2 Patched in 5.1.3
23. Medium · 5.3 User Registration <= 4.4.6 - Missing Authorization ↗
    2026-01-21 CVE-2025-67956 Missing Authorization Affects <= 4.4.6 Patched in 4.4.7
24. Medium · 5.4 User Registration & Membership <= 4.4.8 - Cross-Site Request Forgery to Arbitrary Post Deletion ↗
    2026-01-09 CVE-2025-14976 Cross-Site Request Forgery (CSRF) Affects <= 4.4.8 Patched in 4.4.9
25. Medium · 5.4 User Registration <= 4.4.9 - Authenticated (Subscriber+) Arbitrary Shortcode Execution ↗
    2026-01-08 CVE-2026-24353 Improper Control of Generation of Code ('Code Injection') Affects <= 4.4.9 Patched in 5.0
26. Medium · 6.4 User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ↗
    2025-12-15 CVE-2025-13367 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.4.6 Patched in 4.4.7
27. Medium · 4.9 User Registration & Membership <= 4.3.0 - Authenticated (Admin+) SQL Injection ↗
    2025-09-05 CVE-2025-9085 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 4.3.0 Patched in 4.4.0
28. Medium · 6.4 User Registration <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via urcr_restrict Shortcode ↗
    2025-07-21 CVE-2025-6831 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.2.4 Patched in 4.3.0
29. Medium · 5.3 User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.2.1 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion ↗
    2025-05-05 CVE-2025-3281 Authorization Bypass Through User-Controlled Key Affects <= 4.2.1 Patched in 4.2.2
30. Medium · 6.1 User Registration <= 4.1.5 - Reflected Cross-Site Scripting ↗
    2025-04-22 CVE-2025-39400 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.1.5 Patched in 4.2.0
31. Medium · 4.3 User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Password Update ↗
    2025-04-11 CVE-2025-3292 Authorization Bypass Through User-Controlled Key Affects <= 4.1.3 Patched in 4.1.4
32. Medium · 5.3 User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Unauthenticated Membership Modification ↗
    2025-04-11 CVE-2025-3282 Authorization Bypass Through User-Controlled Key Affects <= 4.1.3 Patched in 4.1.4
33. High · 8.1 User Registration & Membership <= 4.1.2 - Authentication Bypass ↗
    2025-04-01 CVE-2025-2594 Authentication Bypass Using an Alternate Path or Channel Affects <= 4.1.2 Patched in 4.1.3
34. Medium · 4.4 User Registration <= 4.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2025-03-27 CVE-2025-30899 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.0.3 Patched in 4.0.4
35. Critical · 9.8 User Registration & Membership <= 4.1.1 - Unauthenticated Privilege Escalation ↗
    2025-03-24 CVE-2025-2563 Improper Privilege Management Affects <= 4.1.1 Patched in 4.1.2
36. Medium · 6.1 User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.0.4 - Reflected Cross-Site Scripting ↗
    2025-02-27 CVE-2025-1511 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.0.4 Patched in 4.1.0
37. High · 7.1 User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.2.0.1 - Missing Authorization to Privilege Escalation ↗
    2024-05-31 CVE-2024-4958 Missing Authorization Affects <= 3.2.0.1 Patched in 3.2.1
38. High · 8.8 User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation ↗
    2024-04-19 CVE-2024-2417 Missing Authorization Affects <= 3.1.5 Patched in 3.2.0
39. Medium · 6.5 User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Unauthenticated Media Deletion ↗
    2024-04-15 CVE-2024-3295 Missing Authorization Affects <= 3.1.5 Patched in 3.2.0
40. Medium · 4.7 User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.4 - Unauthenticated Stored Self-Based Cross-Site Scripting ↗
    2024-03-06 CVE-2024-1720 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.1.4 Patched in 3.1.5
41. Medium · 4.4 User Registration – Custom Registration Form, Login Form And User Profile For WordPress <= 3.0.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2023-10-16 CVE-2023-5228 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.0.4.1 Patched in 3.0.4.2
42. Critical · 9.9 User Registration <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Upload ↗
    2023-07-04 CVE-2023-3342 Unrestricted Upload of File with Dangerous Type Affects <= 3.0.2 Patched in 3.0.2.1
43. High · 8.8 User Registration <= 3.0.1 - Authenticated (Subscriber+) PHP Object Injection ↗
    2023-06-29 CVE-2023-3343 Deserialization of Untrusted Data Affects <= 3.0.1 Patched in 3.0.2
44. Medium · 5.3 User Registration <= 2.3.2.1 - Missing Authorization via send_test_email ↗
    2023-04-06 CVE-2023-29429 Missing Authorization Affects <= 2.3.2.1 Patched in 2.3.3
45. High · 7.5 User Registration <= 2.3.2.1 - PHP Object Injection ↗
    2023-03-21 CVE-2023-27459 Deserialization of Untrusted Data Affects <= 2.3.2.1 Patched in 2.3.3
46. Medium · 5.5 User Registration <= 2.3.0 - Authenticated (Administrator+) Stored Cross Site Scripting ↗
    2023-01-20 CVE-2023-23987 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.3.0 Patched in 2.3.1
47. High · 8.8 User Registration <= 2.2.4 - Authenticated (Subscriber+) Arbitrary File Upload ↗
    2022-11-21 CVE-2022-3912 Unrestricted Upload of File with Dangerous Type Affects <= 2.2.4 Patched in 2.2.41
48. Medium · 6.4 User Registration <= 1.5.5 - Cross-Site Scripting ↗
    2019-01-09 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.5.5 Patched in 1.5.6

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 17 languages, 1 at 90% or more

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-06-28 60K+ → 50K+ down after 353 days in tier
2. 2025-07-10 70K+ → 60K+ down after 4 days in tier
3. 2025-07-06 60K+ → 70K+ up after 2 days in tier
4. 2025-07-04 70K+ → 60K+ down after 2 days in tier
5. 2025-07-02 60K+ → 70K+ up after 2 days in tier
6. 2025-06-30 70K+ → 60K+ down after 63 days in tier
7. 2025-04-28 60K+ → 70K+ up after 301 days in tier
8. 2024-07-01 70K+ → 60K+ down after 76 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin 200K+ installs · 4.4★ · 3 shared tags A
• Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress 100K+ installs · 3.1★ · 3 shared tags B
• User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission 20K+ installs · 4.1★ · 3 shared tags A
• WP User Manager – User Profile Builder & Membership 10K+ installs · 4.7★ · 3 shared tags A
• Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction 10K+ installs · 4.7★ · 3 shared tags A
• Membership For WooCommerce 900+ installs · 4.3★ · 3 shared tags A

Embed this report card

Drop a live Pulse card for User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder into a readme, a review or a deck. It updates itself.

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder: 50K+ active installs, 4.8★ (828 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/user-registration