Vulnerabilities in wpeverest
69 resultsCVE-2026-13167MEDIUMEverest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX EndpointsEPSS 0.5%CVE-2026-6145MEDIUMUser Registration & Membership <= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' ParameterEPSS 0.4%CVE-2025-3281MEDIUMUser Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.2.1 - Insecure Direct Object Reference to Unauthenticated Limited User DeletionEPSS 0.4%CVE-2026-89101MEDIUMEverest Forms <= 3.6.2 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP /tools/call JSON-RPC EndpointEPSS 0.4%CVE-2023-29429MEDIUMWordPress User Registration plugin <= 2.3.2.1 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-5096MEDIUMEverest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'EPSS 0.4%CVE-2026-1779HIGHUser Registration & Membership <= 5.1.2 - Authentication BypassEPSS 0.4%CVE-2023-23987MEDIUMWordPress User Registration Plugin <= 2.3.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-92798HIGHUser Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart TagEPSS 0.4%CVE-2025-67956HIGHWordPress User Registration plugin <= 4.4.6 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-3421MEDIUMEverest Forms <= 3.1.1 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2025-6831MEDIUMUser Registration <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via urcr_restrict ShortcodeEPSS 0.4%CVE-2026-73995MEDIUMWordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerabilityEPSS 0.4%CVE-2026-32488HIGHWordPress User Registration plugin <= 4.4.9 - Privilege Escalation vulnerabilityEPSS 0.4%CVE-2025-9085MEDIUMUser Registration & Membership <= 4.3.0 - Authenticated (Admin+) SQL InjectionEPSS 0.4%CVE-2026-12124MEDIUMPDFDraft <= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure via 'slug' ParameterEPSS 0.4%CVE-2026-7651MEDIUMUser Registration & Membership <= 5.1.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via 'profile-pic-url' ParameterEPSS 0.4%CVE-2026-91152MEDIUMEverest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' ParameterEPSS 0.3%CVE-2023-51695MEDIUMWordPress Everest Forms Plugin <= 2.0.4.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-4958HIGHUser Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.2.0.1 - Missing Authorization to Privilege EscalationEPSS 0.3%