User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

867 searches this plugin appeared in over the last 90 days, 20 listed. 745 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 4 months ago; a band this size takes about a year or more to cross, which places it about 65% of the way through.

Recent releases and news for this plugin

1. — Version 5.2.6 Enhance – Compatibility with divi 5. Enhance – Allow 100% discount coupons on memberships. Enhance – Redirect hint links to Enable Custom Redirect setting. Fix – Local currency bugs. Fix – Double Charge on Upgrade. Fix – 5.2.6
2. — Version 5.2.5 Enhance – Defer expiry to period end. Enhance – Pin Stripe subscription payment method for reliable renewals. Fix – User and admin email order. Fix – Payment fail case for paypal. Fix – Lost Password Carrot adjustment. F 5.2.5
3. — Version 5.2.4 Enhance – User role overwritten on new membership assignment. Enhance – Add customizable membership registration success message in settings. Fix – Duplicate variable. Fix – Invoice dynamic content not translatable. Fix 5.2.4
4. — Version 5.2.3 Fix – validation for receiver email and payment amount in PayPal IPN handling. Fix – Selected membership tier during registration missed proper validation, allowing assignment of off-form membership tiers. Fix – Stripe s 5.2.3
5. — Version 5.2.2 Dev – Add UR_WPML compatibility service class. Fix – Password reset link shows “invalid or expired” error. Fix – Membership subscriptions stuck pending on 3D Secure (SCA) cards. Fix – Hardcoded database table names causi 5.2.2
6. — Version 5.2.1 Fix – Stripe order validation issue. Fix – Membership upgrade action not available after disabling group add-on. Fix – Custom emails addon cannot be enabled with plus plan even available in personal. Fix – Nav menu items 5.2.1

All 67 disclosed vulnerabilities are patched in the current version (5.3.1). Sites still on an older version should update.

1. Patched High · 8.1 User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag ↗
   2026-10-16 CVE-2026-92798 Improper Control of Generation of Code Affects <= 5.2.8 Patched in 5.3.0
2. Patched Medium · 4.3 User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action() ↗
   2026-10-16 CVE-2026-92978 Cross-Site Request Forgery Affects <= 5.2.8 Patched in 5.3.0
3. Patched High · 7.2 User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value ↗
   2026-10-16 CVE-2026-96660 Improper Neutralization of Input During Web Page Generation Affects <= 5.2.8 Patched in 5.3.0
4. Patched Medium · 5.4 User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name ↗
   2026-10-15 CVE-2026-15222 Improper Control of Generation of Code Affects <= 5.2.8 Patched in 5.3.0
5. Patched Medium · 6.4 User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
   2026-10-13 CVE-2026-105882 Improper Neutralization of Input During Web Page Generation Affects <= 5.2.8 Patched in 5.3.0
6. Patched Medium · 4.3 User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.8 - Missing Authorization ↗
   2026-10-13 CVE-2026-109692 Missing Authorization Affects <= 5.2.8 Patched in 5.3.0
7. Patched Medium · 5.3 User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.8 - Missing Authorization ↗
   2026-10-13 CVE-2026-106597 Missing Authorization Affects <= 5.2.8 Patched in 5.3.0
8. Patched Medium · 5.3 User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.8 - Unauthenticated Information Exposure ↗
   2026-10-13 CVE-2026-106598 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 5.2.8 Patched in 5.3.0
9. Patched Medium · 5.3 User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.8 - Missing Authorization ↗
   2026-10-13 CVE-2026-109699 Missing Authorization Affects <= 5.2.8 Patched in 5.3.0
10. Patched Medium · 4.3 User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.8 - Cross-Site Request Forgery ↗
    2026-10-13 CVE-2026-103076 Cross-Site Request Forgery Affects <= 5.2.8 Patched in 5.3.0
11. Patched Medium · 6.4 User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2026-10-13 CVE-2026-105881 Improper Neutralization of Input During Web Page Generation Affects <= 5.2.8 Patched in 5.3.0
12. Patched Medium · 5.3 User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.7 - Missing Authorization ↗
    2026-10-04 CVE-2026-96334 Missing Authorization Affects <= 5.2.7 Patched in 5.2.8
13. Patched Medium · 5.3 User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.7 - Missing Authorization ↗
    2026-09-16 CVE-2026-74017 Missing Authorization Affects <= 5.2.7 Patched in 5.2.8
14. Patched Medium · 6.3 User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder < 5.2.8 - Authenticated (Author+) Privilege Escalation ↗
    2026-09-14 CVE-2026-80071 Improper Privilege Management Affects < 5.2.8 Patched in 5.2.8
15. Patched Medium · 6.3 User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder 4.4.6 - 5.2.7 - Authenticated (Subscriber+) Privilege Escalation ↗
    2026-09-14 CVE-2026-86406 Improper Privilege Management Affects 4.4.6 - 5.2.7 Patched in 5.2.8
16. Patched Medium · 5.3 User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder 5.0 - 5.2.7 - Unauthenticated Information Exposure ↗
    2026-09-13 CVE-2026-86407 Exposure of Sensitive Information to an Unauthorized Actor Affects 5.0 - 5.2.7 Patched in 5.2.8
17. Patched High · 7.2 User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder < 5.2.8 - Unauthenticated Open Redirect ↗
    2026-09-11 CVE-2026-80072 URL Redirection to Untrusted Site Affects < 5.2.8 Patched in 5.2.8
18. Patched Medium · 4.3 User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder < 5.2.5 - Authenticated (Subscriber+) Insecure Direct Object Reference ↗
    2026-08-28 CVE-2026-79995 Authorization Bypass Through User-Controlled Key Affects < 5.2.5 Patched in 5.2.5
19. Patched Medium · 6.3 User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder < 5.2.6 - Authenticated (Custom Role+) Privilege Escalation ↗
    2026-08-28 CVE-2026-79996 Improper Privilege Management Affects < 5.2.6 Patched in 5.2.6
20. Patched Medium · 4.3 User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.6 - Missing Authorization ↗
    2026-08-14 CVE-2026-73995 Missing Authorization Affects <= 5.2.6 Patched in 5.2.7
21. Patched Medium · 5.3 User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.6 - Missing Authorization ↗
    2026-08-13 CVE-2026-73403 Missing Authorization Affects <= 5.2.6 Patched in 5.2.7
22. Patched Medium · 5.3 User Registration & Membership <= 5.2.5 - Missing Authorization to Unauthenticated Account Creation While Registration Disabled ↗
    2026-07-27 CVE-2026-16736 Missing Authorization Affects <= 5.2.5 Patched in 5.2.6
23. Patched Medium · 5.3 User Registration & Membership <= 5.2.2 - Missing Authorization to Unauthenticated User Deletion via Stripe Handler ↗
    2026-06-26 CVE-2026-11966 Authorization Bypass Through User-Controlled Key Affects <= 5.2.2 Patched in 5.2.3
24. Patched High · 8.1 User Registration & Membership <= 5.2.2 - Unauthenticated Privilege Escalation ↗
    2026-06-26 CVE-2026-11961 Improper Privilege Management Affects <= 5.2.2 Patched in 5.2.3
25. Patched Medium · 6.5 User Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypass ↗
    2026-06-25 CVE-2026-1869 Missing Authorization Affects <= 5.2.0 Patched in 5.2.1
26. Patched Medium · 5.3 User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.2 - Missing Authorization ↗
    2026-06-22 CVE-2026-52701 Missing Authorization Affects <= 5.2.2 Patched in 5.2.3
27. Patched Medium · 5.3 User Registration & Membership <= 5.2.1 - Unauthenticated PayPal Bypass to Membership Activation ↗
    2026-06-22 CVE-2026-11964 Improper Authentication Affects <= 5.2.1 Patched in 5.2.2
28. Patched Medium · 4.3 User Registration & Membership <= 5.2.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Membership Tier Modification ↗
    2026-06-22 CVE-2026-11963 Authorization Bypass Through User-Controlled Key Affects <= 5.2.1 Patched in 5.2.2
29. Patched Medium · 5.3 User Registration & Membership <= 5.1.0 - Unauthenticated Payment Bypass ↗
    2026-06-11 CVE-2026-11965 Client-Side Enforcement of Server-Side Security Affects <= 5.1.0 Patched in 5.2.0
30. Patched Medium · 5.3 User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.1.2 - Missing Authorization ↗
    2026-05-28 CVE-2026-25425 Missing Authorization Affects <= 5.1.2 Patched in 5.1.3
31. Patched Medium · 5.3 User Registration & Membership <= 5.1.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via 'profile-pic-url' Parameter ↗
    2026-05-27 CVE-2026-7651 Authorization Bypass Through User-Controlled Key Affects <= 5.1.5 Patched in 5.1.6
32. Patched Medium · 5.3 User Registration & Membership <= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter ↗
    2026-05-13 CVE-2026-6145 Missing Authorization Affects <= 5.1.5 Patched in 5.1.6
33. Patched Medium · 4.3 User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Limited Page Content Modification ↗
    2026-05-04 CVE-2026-3601 Missing Authorization Affects <= 5.1.4 Patched in 5.1.5
34. Patched Medium · 6.1 User Registration & Membership <= 5.1.4 - Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter ↗
    2026-04-13 CVE-2026-6203 URL Redirection to Untrusted Site Affects <= 5.1.4 Patched in 5.1.5
35. Patched Medium · 6.1 User Registration <= 5.1.5 - Reflected Cross-Site Scripting ↗
    2026-04-09 CVE-2026-42652 Improper Neutralization of Input During Web Page Generation Affects <= 5.1.5 Patched in 5.1.6
36. Patched Medium · 6.5 User Registration & Membership <= 5.1.2 - Authenticated (Subscriber+) SQL Injection via membership_ids[] ↗
    2026-04-07 CVE-2026-1865 Improper Neutralization of Special Elements used in an SQL Command Affects <= 5.1.2 Patched in 5.1.3
37. Patched Medium · 5.4 User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation ↗
    2026-03-23 CVE-2026-4056 Missing Authorization Affects <= 5.1.4 Patched in 5.1.5
38. Patched Critical · 9.8 User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 4.4.9 - Unauthenticated Remote Code Execution ↗
    2026-03-23 CVE-2026-32488 Incorrect Privilege Assignment Affects <= 4.4.9 Patched in 5.1.3
39. Patched Critical · 9.8 User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration ↗
    2026-03-02 CVE-2026-1492 Improper Privilege Management Affects <= 5.1.2 Patched in 5.1.3
40. Patched Medium · 5.3 User Registration & Membership <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion ↗
    2026-02-25 CVE-2026-2356 Improper Access Control Affects <= 5.1.2 Patched in 5.1.3
41. Patched High · 8.1 User Registration & Membership <= 5.1.2 - Authentication Bypass ↗
    2026-02-25 CVE-2026-1779 Authentication Bypass Using an Alternate Path or Channel Affects <= 5.1.2 Patched in 5.1.3
42. Patched Medium · 5.3 User Registration <= 4.4.6 - Missing Authorization ↗
    2026-01-21 CVE-2025-67956 Missing Authorization Affects <= 4.4.6 Patched in 4.4.7
43. Patched Medium · 5.4 User Registration & Membership <= 4.4.8 - Cross-Site Request Forgery to Arbitrary Post Deletion ↗
    2026-01-09 CVE-2025-14976 Cross-Site Request Forgery Affects <= 4.4.8 Patched in 4.4.9
44. Patched Medium · 5.4 User Registration <= 4.4.9 - Authenticated (Subscriber+) Arbitrary Shortcode Execution ↗
    2026-01-08 CVE-2026-24353 Improper Control of Generation of Code Affects <= 4.4.9 Patched in 5.0
45. Patched Medium · 6.4 User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ↗
    2025-12-15 CVE-2025-13367 Improper Neutralization of Input During Web Page Generation Affects <= 4.4.6 Patched in 4.4.7
46. Patched Medium · 4.9 User Registration & Membership <= 4.3.0 - Authenticated (Admin+) SQL Injection ↗
    2025-09-05 CVE-2025-9085 Improper Neutralization of Special Elements used in an SQL Command Affects <= 4.3.0 Patched in 4.4.0
47. Patched Medium · 6.4 User Registration <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via urcr_restrict Shortcode ↗
    2025-07-21 CVE-2025-6831 Improper Neutralization of Input During Web Page Generation Affects <= 4.2.4 Patched in 4.3.0
48. Patched Medium · 5.3 User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.2.1 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion ↗
    2025-05-05 CVE-2025-3281 Authorization Bypass Through User-Controlled Key Affects <= 4.2.1 Patched in 4.2.2
49. Patched Medium · 6.1 User Registration <= 4.1.5 - Reflected Cross-Site Scripting ↗
    2025-04-22 CVE-2025-39400 Improper Neutralization of Input During Web Page Generation Affects <= 4.1.5 Patched in 4.2.0
50. Patched Medium · 4.3 User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Password Update ↗
    2025-04-11 CVE-2025-3292 Authorization Bypass Through User-Controlled Key Affects <= 4.1.3 Patched in 4.1.4
51. Patched Medium · 5.3 User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Unauthenticated Membership Modification ↗
    2025-04-11 CVE-2025-3282 Authorization Bypass Through User-Controlled Key Affects <= 4.1.3 Patched in 4.1.4
52. Patched High · 8.1 User Registration & Membership <= 4.1.2 - Authentication Bypass ↗
    2025-04-01 CVE-2025-2594 Authentication Bypass Using an Alternate Path or Channel Affects <= 4.1.2 Patched in 4.1.3
53. Patched Medium · 4.4 User Registration <= 4.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2025-03-27 CVE-2025-30899 Improper Neutralization of Input During Web Page Generation Affects <= 4.0.3 Patched in 4.0.4
54. Patched Critical · 9.8 User Registration & Membership <= 4.1.1 - Unauthenticated Privilege Escalation ↗
    2025-03-24 CVE-2025-2563 Improper Privilege Management Affects <= 4.1.1 Patched in 4.1.2
55. Patched Medium · 6.1 User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.0.4 - Reflected Cross-Site Scripting ↗
    2025-02-27 CVE-2025-1511 Improper Neutralization of Input During Web Page Generation Affects <= 4.0.4 Patched in 4.1.0
56. Patched High · 7.1 User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.2.0.1 - Missing Authorization to Privilege Escalation ↗
    2024-05-31 CVE-2024-4958 Missing Authorization Affects <= 3.2.0.1 Patched in 3.2.1
57. Patched High · 8.8 User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation ↗
    2024-04-19 CVE-2024-2417 Missing Authorization Affects <= 3.1.5 Patched in 3.2.0
58. Patched Medium · 6.5 User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Unauthenticated Media Deletion ↗
    2024-04-15 CVE-2024-3295 Missing Authorization Affects <= 3.1.5 Patched in 3.2.0
59. Patched Medium · 4.7 User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.4 - Unauthenticated Stored Self-Based Cross-Site Scripting ↗
    2024-03-06 CVE-2024-1720 Improper Neutralization of Input During Web Page Generation Affects <= 3.1.4 Patched in 3.1.5
60. Patched Medium · 4.4 User Registration – Custom Registration Form, Login Form And User Profile For WordPress <= 3.0.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2023-10-16 CVE-2023-5228 Improper Neutralization of Input During Web Page Generation Affects <= 3.0.4.1 Patched in 3.0.4.2
61. Patched Critical · 9.9 User Registration <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Upload ↗
    2023-07-04 CVE-2023-3342 Unrestricted Upload of File with Dangerous Type Affects <= 3.0.2 Patched in 3.0.2.1
62. Patched High · 8.8 User Registration <= 3.0.1 - Authenticated (Subscriber+) PHP Object Injection ↗
    2023-06-29 CVE-2023-3343 Deserialization of Untrusted Data Affects <= 3.0.1 Patched in 3.0.2
63. Patched Medium · 5.3 User Registration <= 2.3.2.1 - Missing Authorization via send_test_email ↗
    2023-04-06 CVE-2023-29429 Missing Authorization Affects <= 2.3.2.1 Patched in 2.3.3
64. Patched High · 7.5 User Registration <= 2.3.2.1 - PHP Object Injection ↗
    2023-03-21 CVE-2023-27459 Deserialization of Untrusted Data Affects <= 2.3.2.1 Patched in 2.3.3
65. Patched Medium · 5.5 User Registration <= 2.3.0 - Authenticated (Administrator+) Stored Cross Site Scripting ↗
    2023-01-20 CVE-2023-23987 Improper Neutralization of Input During Web Page Generation Affects <= 2.3.0 Patched in 2.3.1
66. Patched High · 8.8 User Registration <= 2.2.4 - Authenticated (Subscriber+) Arbitrary File Upload ↗
    2022-11-21 CVE-2022-3912 Unrestricted Upload of File with Dangerous Type Affects <= 2.2.4 Patched in 2.2.41
67. Patched Medium · 6.4 User Registration <= 1.5.5 - Cross-Site Scripting ↗
    2019-01-09 Improper Neutralization of Input During Web Page Generation Affects <= 1.5.5 Patched in 1.5.6

Translated into 18 languages, 1 at 90% or more

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-06-28 60K+ → 50K+ down after 353 days in tier
2. 2025-07-10 70K+ → 60K+ down after 4 days in tier
3. 2025-07-06 60K+ → 70K+ up after 2 days in tier
4. 2025-07-04 70K+ → 60K+ down after 2 days in tier
5. 2025-07-02 60K+ → 70K+ up after 2 days in tier
6. 2025-06-30 70K+ → 60K+ down after 63 days in tier
7. 2025-04-28 60K+ → 70K+ up after 301 days in tier
8. 2024-07-01 70K+ → 60K+ down after 76 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder into a readme, a review or a deck. It updates itself.

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder: 50K+ active installs, 4.8★ (832 reviews). Plugin Pulse (WP Mayor), as of 2026-11-01. https://plugins.wpmayor.com/plugin/user-registration