Vulnerabilities in WPEverest

53 results
Vexday analysis

WPEverest apresenta 11 vulnerabilidades catalogadas, com 2 críticas, mas nenhuma sob ataque ativo no momento. A fraqueza dominante é injeção XSS (CWE-79), típica de aplicações web, com apenas 1 CVE publicada nos últimos 90 dias, indicando risco estável e não emergencial. A ausência de exploração ativa atual reduz a urgência, mas o padrão de XSS requer atenção contínua em contextos de aplicação externa.

CVE-2026-4888MEDIUMEverest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder <= 3.4.7 - Missing Authorization to Authenticated (Subscriber+) Email SendingEPSS 0.3%CVE-2025-3282MEDIUMUser Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Unauthenticated Membership ModificationEPSS 0.3%CVE-2026-1869MEDIUMUser Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment BypassEPSS 0.3%CVE-2026-57312HIGHWordPress Everest Forms plugin <= 3.4.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-22422MEDIUMWordPress Everest Forms plugin <= 3.4.1 - Arbitrary Shortcode Execution vulnerabilityEPSS 0.2%CVE-2026-12124MEDIUMPDFDraft <= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure via 'slug' ParameterEPSS 0.2%CVE-2026-2356MEDIUMUser Registration & Membership <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Limited User DeletionEPSS 0.2%CVE-2026-4056MEDIUMUser Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Content Access Rule ManipulationEPSS 0.2%CVE-2026-24353MEDIUMWordPress User Registration plugin <= 4.4.9 - Arbitrary Shortcode Execution vulnerabilityEPSS 0.2%CVE-2026-42652HIGHWordPress User Registration plugin <= 5.1.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2025-3284MEDIUMUser Registration & Membership PRO – Custom Registration Form, Login Form, and User Profile <= 5.1.3 - Cross-Site Request Forgery to User DeletionEPSS 0.1%CVE-2026-27070HIGHWordPress Everest Forms Pro plugin <= 1.9.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2025-14976MEDIUMUser Registration & Membership <= 4.4.8 - Cross-Site Request Forgery to Arbitrary Post DeletionEPSS 0.1%