Vulnerabilities in wpeverest
70 resultsCVE-2025-3422MEDIUMEverest Forms <= 3.1.1 - Authenticated (Subscriber+) Arbitrary Shortcode ExecutionEPSS 0.3%CVE-2025-1511MEDIUMUser Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.0.4 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-3292MEDIUMUser Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Password UpdateEPSS 0.3%CVE-2025-30899MEDIUMWordPress User Registration plugin <= 4.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-74017MEDIUMWordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2023-51377MEDIUMWordPress Everest Forms plugin <= 2.0.3 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-1865MEDIUMUser Registration & Membership <= 5.1.2 - Authenticated (Subscriber+) SQL Injection via membership_ids[]EPSS 0.3%CVE-2026-1869MEDIUMUser Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment BypassEPSS 0.3%CVE-2026-3601MEDIUMUser Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Limited Page Content ModificationEPSS 0.3%CVE-2025-8871MEDIUMEverest Forms (Pro) <= 1.9.7 - Unauthenticated PHP Object Injection via PHAR Deserialization in Form SignatureEPSS 0.3%CVE-2025-39400HIGHWordPress User Registration plugin < 4.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-73403MEDIUMWordPress User Registration plugin <= 5.2.6 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-3282MEDIUMUser Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Unauthenticated Membership ModificationEPSS 0.3%CVE-2025-13367MEDIUMUser Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.3%CVE-2026-4888MEDIUMEverest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder <= 3.4.7 - Missing Authorization to Authenticated (Subscriber+) Email SendingEPSS 0.3%CVE-2026-22422MEDIUMWordPress Everest Forms plugin <= 3.4.1 - Arbitrary Shortcode Execution vulnerabilityEPSS 0.3%CVE-2026-57312HIGHWordPress Everest Forms plugin <= 3.4.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-27061MEDIUMWordPress User Registration plugin <= 5.3.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-96660HIGHUser Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field ValueEPSS 0.2%CVE-2026-2356MEDIUMUser Registration & Membership <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Limited User DeletionEPSS 0.2%