Wpeverest vulnerabilities
71 CVEs and advisories name Wpeverest as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-3296Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata
- CVE-2026-3300Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field
- CVE-2026-32488WordPress User Registration plugin <= 4.4.9 - Privilege Escalation vulnerability
- CVE-2026-4056User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation
- CVE-2026-27070WordPress Everest Forms Pro plugin <= 1.9.10 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-1492User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration
- CVE-2026-1779User Registration & Membership <= 5.1.2 - Authentication Bypass
- CVE-2026-2356User Registration & Membership <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion
- CVE-2026-22422WordPress Everest Forms plugin <= 3.4.1 - Arbitrary Shortcode Execution vulnerability
- CVE-2026-24353WordPress User Registration plugin <= 4.4.9 - Arbitrary Shortcode Execution vulnerability
- CVE-2025-67956WordPress User Registration plugin <= 4.4.6 - Broken Access Control vulnerability
- CVE-2025-14976User Registration & Membership <= 4.4.8 - Cross-Site Request Forgery to Arbitrary Post Deletion
- CVE-2025-13367User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2025-8871Everest Forms (Pro) <= 1.9.7 - Unauthenticated PHP Object Injection via PHAR Deserialization in Form Signature
- CVE-2025-60210WordPress Everest Forms - Frontend Listing plugin <= 1.0.5 - PHP Object Injection Vulnerability
- CVE-2025-9085User Registration & Membership <= 4.3.0 - Authenticated (Admin+) SQL Injection
- CVE-2025-6831User Registration <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via urcr_restrict Shortcode
- CVE-2025-5927Everest Forms (Pro) <= 1.9.4 - Unauthenticated Path Traversal to Arbitrary File Deletion
- CVE-2025-3281User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.2.1 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion
- CVE-2025-39400WordPress User Registration plugin < 4.2.0 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2025-3284User Registration & Membership PRO – Custom Registration Form, Login Form, and User Profile <= 5.1.3 - Cross-Site Request Forgery to User Deletion
- CVE-2025-3282User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Unauthenticated Membership Modification
- CVE-2025-3292User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Password Update
- CVE-2025-3421Everest Forms <= 3.1.1 - Reflected Cross-Site Scripting
- CVE-2025-3422Everest Forms <= 3.1.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
- CVE-2025-3439Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress <= 3.1.1 - Unauthenticated PHP Object Injection
- CVE-2025-30899WordPress User Registration plugin <= 4.0.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-1511User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.0.4 - Reflected Cross-Site Scripting
- CVE-2025-1128Everest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion
- CVE-2023-29429WordPress User Registration plugin <= 2.3.2.1 - Broken Access Control vulnerability