Wpeverest vulnerabilities
71 CVEs and advisories name Wpeverest as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-115483Everest Forms <= 3.6.3 - Unauthenticated Arbitrary File Read via 'Signature' Field Meta Key Branch of attach_entry_files
- CVE-2026-120513Everest Forms <= 3.6.2 - Unauthenticated Arbitrary File Deletion via 'everest_forms_{form_id}_old_{field_id}' Parameter
- CVE-2026-89101Everest Forms <= 3.6.2 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP…
- CVE-2026-27061WordPress User Registration plugin <= 5.3.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-91153Everest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})
- CVE-2026-91152Everest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' Parameter
- CVE-2026-92798User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag
- CVE-2026-92978User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()
- CVE-2026-96660User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value
- CVE-2026-87111User Registration PRO <= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer Header
- CVE-2026-15222User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name
- CVE-2026-74017WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability
- CVE-2026-62103WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability
- CVE-2026-5096Everest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'
- CVE-2026-74001WordPress User Registration & Membership Pro plugin <= 5.4.5 - Account Takeover vulnerability
- CVE-2026-73995WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability
- CVE-2026-13167Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints
- CVE-2026-73403WordPress User Registration plugin <= 5.2.6 - Broken Access Control vulnerability
- CVE-2026-12124PDFDraft <= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure via 'slug' Parameter
- CVE-2026-57312WordPress Everest Forms plugin <= 3.4.8 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-1869User Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypass
- CVE-2026-7651User Registration & Membership <= 5.1.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via 'profile-pic-url' Parameter
- CVE-2026-4888Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder <= 3.4.7 - Missing Authorization to Authenticated (Subscriber+) Email Sending
- CVE-2026-6145User Registration & Membership <= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter
- CVE-2026-3601User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Limited Page Content Modification
- CVE-2026-4882User Registration Advanced Fields <= 1.6.20 - Unauthenticated Arbitrary File Upload
- CVE-2026-42652WordPress User Registration plugin <= 5.1.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-5478Everest Forms <= 3.4.4 - Unauthenticated Arbitrary File Read and Deletion via Upload Field 'old_files' Parameter
- CVE-2026-6203User Registration & Membership <= 5.1.4 - Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter
- CVE-2026-1865User Registration & Membership <= 5.1.2 - Authenticated (Subscriber+) SQL Injection via membership_ids[]