Wpeverest
66 CVEs across 15 Wpeverest products. Browse Wpeverest vulnerabilities, severities, and proof-of-concept exploits.
Wpeverest products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-73403 | Medium | 5.3 | 2026-08-13 | Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions. |
CVE-2026-12124 | Medium | 5.3 | 2026-07-28 | The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized acc… |
CVE-2026-57312 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in Everest Forms <= 3.4.8 versions. |
CVE-2026-1869 | Medium | 6.5 | 2026-06-26 | The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin… |
CVE-2026-7651 | Medium | 5.3 | 2026-05-28 | The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin… |
CVE-2026-4888 | Medium | 4.3 | 2026-05-28 | The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder plugin for WordPress is vulnerable to unauthorized email sending due to a mi… |
CVE-2026-6145 | Medium | 5.3 | 2026-05-14 | The User Registration & Membership plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.1.5. This is due to the… |
CVE-2026-3601 | Medium | 4.3 | 2026-05-05 | The User Registration & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `embed_form… |
CVE-2026-4882 | Critical | 9.8 | 2026-05-02 | The User Registration Advanced Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'URAF_AJAX::metho… |
CVE-2026-42652 | High | 7.1 | 2026-04-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration user-registration allows Refl… |
CVE-2026-5478 | High | 8.1 | 2026-04-20 | The Everest Forms plugin for WordPress is vulnerable to Arbitrary File Read and Deletion in all versions up to, and including, 3.4.4. This is due to the plugin… |
CVE-2026-6203 | Medium | 6.1 | 2026-04-13 | The User Registration & Membership plugin for WordPress is vulnerable to Open Redirect in versions up to and including 5.1.4. This is due to insufficient valid… |
CVE-2026-1865 | Medium | 6.5 | 2026-04-08 | The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin… |
CVE-2026-3296 | Critical | 9.8 | 2026-04-08 | The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input… |
CVE-2026-3300 | Critical | 9.8 | 2026-03-31 | The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is… |
CVE-2026-32488 | High | 8.1 | 2026-03-25 | Incorrect Privilege Assignment vulnerability in wpeverest User Registration user-registration allows Privilege Escalation.This issue affects User Registration… |
CVE-2026-4056 | Medium | 5.4 | 2026-03-24 | The User Registration & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Content Acc… |
CVE-2026-27070 | High | 7.1 | 2026-03-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPEverest Everest Forms Pro allows Stored XSS.This issue… |
CVE-2026-1492 | Critical | 9.8 | 2026-03-03 | The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for Word… |
CVE-2026-2356 | Medium | 5.3 | 2026-02-26 | The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Refere… |
CVE-2026-1779 | High | 8.1 | 2026-02-26 | The User Registration & Membership plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.2. This is due to incorrec… |
CVE-2026-22422 | Medium | 5.3 | 2026-02-19 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in wpeverest Everest Forms everest-forms allows Code Injection.This… |
CVE-2026-24353 | Medium | 4.3 | 2026-01-22 | Missing Authorization vulnerability in wpeverest User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-67956 | High | 8.2 | 2026-01-22 | Missing Authorization vulnerability in wpeverest User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-14976 | Medium | 5.4 | 2026-01-10 | The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for Word… |
CVE-2025-13367 | Medium | 6.4 | 2025-12-15 | The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin for WordPress i… |
CVE-2025-8871 | Medium | 5.6 | 2025-11-05 | The Everest Forms (Pro) plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deserialization of untrusted… |
CVE-2025-60210 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in wpeverest Everest Forms - Frontend Listing everest-forms-frontend-listing allows Object Injection.This issue… |
CVE-2025-9085 | Medium | 4.9 | 2025-09-06 | The User Registration & Membership plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in version 4.3.0. This is due to insufficient esca… |
CVE-2025-6831 | Medium | 6.4 | 2025-07-22 | The User Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's urcr_restrict shortcode in all versions up to, and inc… |
CVE-2025-5927 | High | 7.5 | 2025-06-25 | The Everest Forms (Pro) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() func… |
CVE-2024-8542 | Medium | 4.8 | 2025-05-15 | The Everest Forms WordPress plugin before 3.0.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2025-26841 | Medium | 6.1 | 2025-05-12 | Cross Site Scripting vulnerability in WPEVEREST Everest Forms before 3.0.9 allows an attacker to execute arbitrary code via a file upload. |
CVE-2025-3281 | Medium | 5.3 | 2025-05-06 | The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Refere… |
CVE-2025-39400 | High | 7.1 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration user-registration allows Refl… |
CVE-2025-2594 | High | 8.1 | 2025-04-22 | The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowi… |
CVE-2025-3284 | Medium | 4.3 | 2025-04-19 | The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Cross-Site Request Forgery in… |
CVE-2025-2563 | High | 8.1 | 2025-04-14 | The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leadin… |
CVE-2025-3292 | Medium | 4.3 | 2025-04-12 | The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Refere… |
CVE-2025-3282 | Medium | 5.3 | 2025-04-12 | The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Refere… |
CVE-2025-3439 | Critical | 9.8 | 2025-04-11 | The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in a… |
CVE-2025-3422 | Medium | 5.4 | 2025-04-11 | The The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary shortcode e… |
CVE-2025-3421 | Medium | 6.1 | 2025-04-11 | The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scri… |
CVE-2025-30899 | Medium | 5.9 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration user-registration allows Stor… |
CVE-2025-1511 | Medium | 6.1 | 2025-02-28 | The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Reflected Cross-Site Scriptin… |
CVE-2025-1128 | Critical | 9.8 | 2025-02-25 | The Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file upload, r… |
CVE-2024-13125 | Low | 3.5 | 2025-02-13 | The Everest Forms WordPress plugin before 3.0.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2023-29429 | Medium | 5.3 | 2024-12-09 | Missing Authorization vulnerability in WPEverest User Registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects U… |
CVE-2024-10471 | Medium | 4.8 | 2024-11-26 | The Everest Forms WordPress plugin before 3.0.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2023-51377 | Medium | 5.3 | 2024-06-14 | Missing Authorization vulnerability in WPEverest Everest Forms.This issue affects Everest Forms: from n/a through 2.0.3. |
CVE-2024-4958 | High | 7.1 | 2024-06-01 | The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification… |
CVE-2024-3295 | Medium | 6.5 | 2024-05-02 | The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data… |
CVE-2024-2417 | High | 8.8 | 2024-05-02 | The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to privilege escalation due… |
CVE-2024-1812 | High | 7.2 | 2024-04-09 | The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.7 via the 'font_url' parameter. T… |
CVE-2023-27459 | High | 7.4 | 2024-03-26 | Deserialization of Untrusted Data vulnerability in WPEverest User Registration.This issue affects User Registration: from n/a through 2.3.2.1. |
CVE-2024-1720 | Medium | 4.7 | 2024-03-07 | The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripti… |
CVE-2023-51695 | Medium | 5.9 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPEverest Everest Forms – Build Contact Forms, Surveys, P… |
CVE-2023-5228 | Medium | 4.8 | 2023-11-06 | The User Registration WordPress plugin before 3.0.4.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin t… |
CVE-2023-3343 | High | 8.8 | 2023-07-13 | The User Registration plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.0.1 via deserialization of untrusted input… |
CVE-2023-3342 | Critical | 9.9 | 2023-07-13 | The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and missing file type validation on the 'u… |
CVE-2023-23987 | Medium | 5.9 | 2023-04-06 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPEverest User Registration plugin <= 2.3.0 versions. |
CVE-2022-3912 | High | 7.5 | 2022-12-12 | The User Registration WordPress plugin before 2.2.4.1 does not properly restrict the files to be uploaded via an AJAX action available to both unauthenticated… |
CVE-2021-24689 | Medium | 4.9 | 2022-02-28 | The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server… |
CVE-2021-24907 | Medium | 6.1 | 2021-12-21 | The Contact Form, Drag and Drop Form Builder for WordPress plugin before 1.8.0 does not escape the status parameter before outputting it back in an attribute… |
CVE-2021-24654 | Medium | 5.4 | 2021-10-04 | The User Registration WordPress plugin before 2.0.2 does not properly sanitise the user_registration_profile_pic_url value when submitted directly via the user… |
CVE-2019-13575 | Critical | 9.8 | 2019-07-18 | A SQL injection vulnerability exists in WPEverest Everest Forms plugin for WordPress through 1.4.9. Successful exploitation of this vulnerability would allow a… |