Vulnerabilities in wpeverest

60 results
Vexday analysis

A WPEverest apresenta 41 vulnerabilidades catalogadas, sendo 6 críticas (CVSS), com nenhuma sob ataque ativo conhecido até o momento. A fraqueza dominante é falha de autorização (CWE-862), e o ritmo de descoberta permanece ativo com 7 CVEs publicadas nos últimos 90 dias, sinalizando exposições recentes que demandam acompanhamento.

CVE-2026-6145MEDIUMUser Registration & Membership <= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' ParameterEPSS 0.4%CVE-2023-29429MEDIUMWordPress User Registration plugin <= 2.3.2.1 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-5096MEDIUMEverest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'EPSS 0.4%CVE-2025-3281MEDIUMUser Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.2.1 - Insecure Direct Object Reference to Unauthenticated Limited User DeletionEPSS 0.4%CVE-2023-23987MEDIUMWordPress User Registration Plugin <= 2.3.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-7651MEDIUMUser Registration & Membership <= 5.1.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via 'profile-pic-url' ParameterEPSS 0.4%CVE-2026-32488HIGHWordPress User Registration plugin <= 4.4.9 - Privilege Escalation vulnerabilityEPSS 0.4%CVE-2026-73995MEDIUMWordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerabilityEPSS 0.4%CVE-2025-67956HIGHWordPress User Registration plugin <= 4.4.6 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-1779HIGHUser Registration & Membership <= 5.1.2 - Authentication BypassEPSS 0.4%CVE-2026-3601MEDIUMUser Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Limited Page Content ModificationEPSS 0.4%CVE-2025-3421MEDIUMEverest Forms <= 3.1.1 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-12124MEDIUMPDFDraft <= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure via 'slug' ParameterEPSS 0.4%CVE-2025-9085MEDIUMUser Registration & Membership <= 4.3.0 - Authenticated (Admin+) SQL InjectionEPSS 0.3%CVE-2023-51695MEDIUMWordPress Everest Forms Plugin <= 2.0.4.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-4958HIGHUser Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.2.0.1 - Missing Authorization to Privilege EscalationEPSS 0.3%CVE-2025-3422MEDIUMEverest Forms <= 3.1.1 - Authenticated (Subscriber+) Arbitrary Shortcode ExecutionEPSS 0.3%CVE-2025-6831MEDIUMUser Registration <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via urcr_restrict ShortcodeEPSS 0.3%CVE-2025-1511MEDIUMUser Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.0.4 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2023-51377MEDIUMWordPress Everest Forms plugin <= 2.0.3 - Broken Access Control vulnerabilityEPSS 0.3%