# cve.now: Wpeverest

The newest entries naming Wpeverest as an affected vendor (up to 200), of 71 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-115483](https://cve.now/CVE-2026-115483.md): Everest Forms \<= 3.6.3 - Unauthenticated Arbitrary File Read via 'Signature' Field Meta Key Branch of attach\_entry\_files (CVSS 7.5)
- [CVE-2026-120513](https://cve.now/CVE-2026-120513.md): Everest Forms \<= 3.6.2 - Unauthenticated Arbitrary File Deletion via 'everest\_forms\_{form\_id}\_old\_{field\_id}' Parameter (CVSS 8.2)
- [CVE-2026-89101](https://cve.now/CVE-2026-89101.md): Everest Forms \<= 3.6.2 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP… (CVSS 6.5)
- [CVE-2026-27061](https://cve.now/CVE-2026-27061.md): WordPress User Registration plugin \<= 5.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-91153](https://cve.now/CVE-2026-91153.md): Everest Forms \<= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post\_meta key=...}) (CVSS 5.3)
- [CVE-2026-91152](https://cve.now/CVE-2026-91152.md): Everest Forms \<= 3.6.2 - Reflected Cross-Site Scripting via 'evf\_toast\_type' Parameter (CVSS 6.1)
- [CVE-2026-92798](https://cve.now/CVE-2026-92798.md): User Registration & Membership \<= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer\_url' Smart Tag (CVSS 8.1)
- [CVE-2026-92978](https://cve.now/CVE-2026-92978.md): User Registration & Membership \<= 5.2.8 - Cross-Site Request Forgery to trigger\_bulk\_action() (CVSS 4.3)
- [CVE-2026-96660](https://cve.now/CVE-2026-96660.md): User Registration & Membership \<= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value (CVSS 7.2)
- [CVE-2026-87111](https://cve.now/CVE-2026-87111.md): User Registration PRO \<= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer Header (CVSS 7.2)
- [CVE-2026-15222](https://cve.now/CVE-2026-15222.md): User Registration & Membership \<= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display\_name (CVSS 5.4)
- [CVE-2026-74017](https://cve.now/CVE-2026-74017.md): WordPress User Registration plugin \<= 5.2.7 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-62103](https://cve.now/CVE-2026-62103.md): WordPress Everest Forms plugin \<= 3.6.0 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-5096](https://cve.now/CVE-2026-5096.md): Everest Forms \<= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value' (CVSS 5.3)
- [CVE-2026-74001](https://cve.now/CVE-2026-74001.md): WordPress User Registration & Membership Pro plugin \<= 5.4.5 - Account Takeover vulnerability (CVSS 9.8)
- [CVE-2026-73995](https://cve.now/CVE-2026-73995.md): WordPress User Registration plugin \<= 5.2.6 - Broken Authentication vulnerability (CVSS 5.4)
- [CVE-2026-13167](https://cve.now/CVE-2026-13167.md): Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI \<= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints (CVSS 4.3)
- [CVE-2026-73403](https://cve.now/CVE-2026-73403.md): WordPress User Registration plugin \<= 5.2.6 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-12124](https://cve.now/CVE-2026-12124.md): PDFDraft \<= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure via 'slug' Parameter (CVSS 5.3)
- [CVE-2026-57312](https://cve.now/CVE-2026-57312.md): WordPress Everest Forms plugin \<= 3.4.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-1869](https://cve.now/CVE-2026-1869.md): User Registration & Membership \<= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypass (CVSS 6.5)
- [CVE-2026-7651](https://cve.now/CVE-2026-7651.md): User Registration & Membership \<= 5.1.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via 'profile-pic-url' Parameter (CVSS 5.3)
- [CVE-2026-4888](https://cve.now/CVE-2026-4888.md): Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder \<= 3.4.7 - Missing Authorization to Authenticated (Subscriber+) Email Sending (CVSS 4.3)
- [CVE-2026-6145](https://cve.now/CVE-2026-6145.md): User Registration & Membership \<= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter (CVSS 5.3)
- [CVE-2026-3601](https://cve.now/CVE-2026-3601.md): User Registration & Membership \<= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Limited Page Content Modification (CVSS 4.3)
- [CVE-2026-4882](https://cve.now/CVE-2026-4882.md): User Registration Advanced Fields \<= 1.6.20 - Unauthenticated Arbitrary File Upload (CVSS 9.8)
- [CVE-2026-42652](https://cve.now/CVE-2026-42652.md): WordPress User Registration plugin \<= 5.1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-5478](https://cve.now/CVE-2026-5478.md): Everest Forms \<= 3.4.4 - Unauthenticated Arbitrary File Read and Deletion via Upload Field 'old\_files' Parameter (CVSS 8.1)
- [CVE-2026-6203](https://cve.now/CVE-2026-6203.md): User Registration & Membership \<= 5.1.4 - Unauthenticated Open Redirect via 'redirect\_to\_on\_logout' Parameter (CVSS 6.1)
- [CVE-2026-1865](https://cve.now/CVE-2026-1865.md): User Registration & Membership \<= 5.1.2 - Authenticated (Subscriber+) SQL Injection via membership\_ids\[\] (CVSS 6.5)
- [CVE-2026-3296](https://cve.now/CVE-2026-3296.md): Everest Forms \<= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata (CVSS 9.8)
- [CVE-2026-3300](https://cve.now/CVE-2026-3300.md): Everest Forms Pro \<= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field (CVSS 9.8)
- [CVE-2026-32488](https://cve.now/CVE-2026-32488.md): WordPress User Registration plugin \<= 4.4.9 - Privilege Escalation vulnerability (CVSS 8.1)
- [CVE-2026-4056](https://cve.now/CVE-2026-4056.md): User Registration & Membership \<= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation (CVSS 5.4)
- [CVE-2026-27070](https://cve.now/CVE-2026-27070.md): WordPress Everest Forms Pro plugin \<= 1.9.10 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-1492](https://cve.now/CVE-2026-1492.md): User Registration & Membership \<= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration (CVSS 9.8)
- [CVE-2026-1779](https://cve.now/CVE-2026-1779.md): User Registration & Membership \<= 5.1.2 - Authentication Bypass (CVSS 8.1)
- [CVE-2026-2356](https://cve.now/CVE-2026-2356.md): User Registration & Membership \<= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion (CVSS 5.3)
- [CVE-2026-22422](https://cve.now/CVE-2026-22422.md): WordPress Everest Forms plugin \<= 3.4.1 - Arbitrary Shortcode Execution vulnerability (CVSS 5.3)
- [CVE-2026-24353](https://cve.now/CVE-2026-24353.md): WordPress User Registration plugin \<= 4.4.9 - Arbitrary Shortcode Execution vulnerability (CVSS 4.3)
- [CVE-2025-67956](https://cve.now/CVE-2025-67956.md): WordPress User Registration plugin \<= 4.4.6 - Broken Access Control vulnerability (CVSS 8.2)
- [CVE-2025-14976](https://cve.now/CVE-2025-14976.md): User Registration & Membership \<= 4.4.8 - Cross-Site Request Forgery to Arbitrary Post Deletion (CVSS 5.4)
- [CVE-2025-13367](https://cve.now/CVE-2025-13367.md): User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin \<= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4)
- [CVE-2025-8871](https://cve.now/CVE-2025-8871.md): Everest Forms (Pro) \<= 1.9.7 - Unauthenticated PHP Object Injection via PHAR Deserialization in Form Signature (CVSS 5.6)
- [CVE-2025-60210](https://cve.now/CVE-2025-60210.md): WordPress Everest Forms - Frontend Listing plugin \<= 1.0.5 - PHP Object Injection Vulnerability (CVSS 9.8)
- [CVE-2025-9085](https://cve.now/CVE-2025-9085.md): User Registration & Membership \<= 4.3.0 - Authenticated (Admin+) SQL Injection (CVSS 4.9)
- [CVE-2025-6831](https://cve.now/CVE-2025-6831.md): User Registration \<= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via urcr\_restrict Shortcode (CVSS 6.4)
- [CVE-2025-5927](https://cve.now/CVE-2025-5927.md): Everest Forms (Pro) \<= 1.9.4 - Unauthenticated Path Traversal to Arbitrary File Deletion (CVSS 7.5)
- [CVE-2025-3281](https://cve.now/CVE-2025-3281.md): User Registration & Membership – Custom Registration Form, Login Form, and User Profile \<= 4.2.1 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion (CVSS 5.3)
- [CVE-2025-39400](https://cve.now/CVE-2025-39400.md): WordPress User Registration plugin \< 4.2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-3284](https://cve.now/CVE-2025-3284.md): User Registration & Membership PRO – Custom Registration Form, Login Form, and User Profile \<= 5.1.3 - Cross-Site Request Forgery to User Deletion (CVSS 4.3)
- [CVE-2025-3282](https://cve.now/CVE-2025-3282.md): User Registration & Membership – Custom Registration Form, Login Form, and User Profile \<= 4.1.3 - Insecure Direct Object Reference to Unauthenticated Membership Modification (CVSS 5.3)
- [CVE-2025-3292](https://cve.now/CVE-2025-3292.md): User Registration & Membership – Custom Registration Form, Login Form, and User Profile \<= 4.1.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Password Update (CVSS 4.3)
- [CVE-2025-3421](https://cve.now/CVE-2025-3421.md): Everest Forms \<= 3.1.1 - Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2025-3422](https://cve.now/CVE-2025-3422.md): Everest Forms \<= 3.1.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution (CVSS 5.4)
- [CVE-2025-3439](https://cve.now/CVE-2025-3439.md): Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress \<= 3.1.1 - Unauthenticated PHP Object Injection (CVSS 9.8)
- [CVE-2025-30899](https://cve.now/CVE-2025-30899.md): WordPress User Registration plugin \<= 4.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2025-1511](https://cve.now/CVE-2025-1511.md): User Registration & Membership – Custom Registration Form, Login Form, and User Profile \<= 4.0.4 - Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2025-1128](https://cve.now/CVE-2025-1128.md): Everest Forms \<= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion (CVSS 9.8)
- [CVE-2023-29429](https://cve.now/CVE-2023-29429.md): WordPress User Registration plugin \<= 2.3.2.1 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2023-51377](https://cve.now/CVE-2023-51377.md): WordPress Everest Forms plugin \<= 2.0.3 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2024-4958](https://cve.now/CVE-2024-4958.md): User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin \<= 3.2.0.1 - Missing Authorization to Privilege Escalation (CVSS 7.1)
- [CVE-2024-2417](https://cve.now/CVE-2024-2417.md): User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin \<= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8)
- [CVE-2024-3295](https://cve.now/CVE-2024-3295.md): User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin \<= 3.1.5 - Missing Authorization to Unauthenticated Media Deletion (CVSS 6.5)
- [CVE-2024-1812](https://cve.now/CVE-2024-1812.md): Everest Forms \<= 2.0.7 - Unauthenticated Server-Side Request Forgery via font\_url (CVSS 7.2)
- [CVE-2023-27459](https://cve.now/CVE-2023-27459.md): WordPress User Registration plugin \<= 2.3.2.1 - Authenticated PHP Object Injection vulnerability (CVSS 7.4)
- [CVE-2024-1720](https://cve.now/CVE-2024-1720.md): User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin \<= 3.1.4 - Unauthenticated Stored Self-Based Cross-Site Scripting (CVSS 4.7)
- [CVE-2023-51695](https://cve.now/CVE-2023-51695.md): WordPress Everest Forms Plugin \<= 2.0.4.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9)
- [CVE-2023-3342](https://cve.now/CVE-2023-3342.md): User Registration \<= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 9.9)
- [CVE-2023-3343](https://cve.now/CVE-2023-3343.md): User Registration \<= 3.0.1 - Authenticated (Subscriber+) PHP Object Injection (CVSS 8.8)
- [CVE-2023-23987](https://cve.now/CVE-2023-23987.md): WordPress User Registration Plugin \<= 2.3.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/wpeverest
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.