Log in Start free

WPEverest

Products

ProductCVEsExploitedLatest
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder28–Oct 17, 2026
User Registration13–Oct 30, 2026
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder8–May 27, 2026
Everest Forms4–Sep 11, 2026
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI4–Oct 29, 2026
Everest Forms Pro4–Mar 31, 2026
User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin2–Oct 16, 2026
PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer1–Jul 28, 2026
Everest Forms - Frontend Listing1–Oct 22, 2025
User Registration & Membership Pro1–Aug 20, 2026
User Registration Advanced Fields1–May 2, 2026
Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease!1–Feb 1, 2024

Exploited and recent CVEs

  • CVE-2026-27061 Medium 6.5 WordPress User Registration plugin <= 5.3.0 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-91153 Medium 5.3 Everest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...}) 0.6%
  • CVE-2026-91152 Medium 6.1 Everest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' Parameter 0.3%
  • CVE-2026-92798 High 8.1 User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag 0.4%
  • CVE-2026-92978 Medium 4.3 User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action() 0.2%
  • CVE-2026-96660 High 7.2 User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value 0.2%
  • CVE-2026-87111 High 7.2 User Registration PRO <= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer Header 0.2%
  • CVE-2026-15222 Medium 5.4 User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name 0.2%
  • CVE-2026-74017 Medium 5.3 WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability 0.3%
  • CVE-2026-62103 Critical 9.8 WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability 0.6%
  • CVE-2026-5096 Medium 5.3 Everest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value' 0.4%
  • CVE-2026-74001 Critical 9.8 WordPress User Registration & Membership Pro plugin <= 5.4.5 - Account Takeover vulnerability 0.6%
  • CVE-2026-73995 Medium 5.4 WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability 0.4%
  • CVE-2026-13167 Medium 4.3 Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints 0.5%
  • CVE-2026-73403 Medium 5.3 WordPress User Registration plugin <= 5.2.6 - Broken Access Control vulnerability 0.3%
  • CVE-2026-12124 Medium 5.3 PDFDraft <= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure via 'slug' Parameter 0.4%
  • CVE-2026-57312 High 7.1 WordPress Everest Forms plugin <= 3.4.8 - Reflected Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2026-1869 Medium 6.5 User Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypass 0.3%
  • CVE-2026-7651 Medium 5.3 User Registration & Membership <= 5.1.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via 'profile-pic-url' Parameter 0.4%
  • CVE-2026-4888 Medium 4.3 Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder <= 3.4.7 - Missing Authorization to Authenticated (Subscriber+) Email Sending 0.3%
  • CVE-2026-6145 Medium 5.3 User Registration & Membership <= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter 0.4%
  • CVE-2026-3601 Medium 4.3 User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Limited Page Content Modification 0.3%
  • CVE-2026-4882 Critical 9.8 User Registration Advanced Fields <= 1.6.20 - Unauthenticated Arbitrary File Upload 0.7%
  • CVE-2026-42652 High 7.1 WordPress User Registration plugin <= 5.1.5 - Cross Site Scripting (XSS) vulnerability 0.1%
  • CVE-2026-5478 High 8.1 Everest Forms <= 3.4.4 - Unauthenticated Arbitrary File Read and Deletion via Upload Field 'old_files' Parameter 1.0%
  • CVE-2026-6203 Medium 6.1 User Registration & Membership <= 5.1.4 - Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter 0.7%
  • CVE-2026-1865 Medium 6.5 User Registration & Membership <= 5.1.2 - Authenticated (Subscriber+) SQL Injection via membership_ids[] 0.3%
  • CVE-2026-3296 Critical 9.8 Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata 3.6%
  • CVE-2026-3300 Critical 9.8 Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field 39.2%
  • CVE-2026-32488 High 8.1 WordPress User Registration plugin <= 4.4.9 - Privilege Escalation vulnerability 0.4%