WPEverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

• CVE-2026-92798 High 8.1 User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag 0.4%
• CVE-2026-92978 Medium 4.3 User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action() 0.2%
• CVE-2026-96660 High 7.2 User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value 0.2%
• CVE-2026-15222 Medium 5.4 User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name 0.2%
• CVE-2026-1869 Medium 6.5 User Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypass 0.3%
• CVE-2026-7651 Medium 5.3 User Registration & Membership <= 5.1.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via 'profile-pic-url' Parameter 0.4%
• CVE-2026-6145 Medium 5.3 User Registration & Membership <= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter 0.4%
• CVE-2026-3601 Medium 4.3 User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Limited Page Content Modification 0.3%
• CVE-2026-6203 Medium 6.1 User Registration & Membership <= 5.1.4 - Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter 0.7%
• CVE-2026-1865 Medium 6.5 User Registration & Membership <= 5.1.2 - Authenticated (Subscriber+) SQL Injection via membership_ids[] 0.3%
• CVE-2026-4056 Medium 5.4 User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation 0.2%
• CVE-2026-1492 Critical 9.8 User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration 28.9%
• CVE-2026-1779 High 8.1 User Registration & Membership <= 5.1.2 - Authentication Bypass 0.4%
• CVE-2026-2356 Medium 5.3 User Registration & Membership <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion 0.2%
• CVE-2025-14976 Medium 5.4 User Registration & Membership <= 4.4.8 - Cross-Site Request Forgery to Arbitrary Post Deletion 0.1%
• CVE-2025-13367 Medium 6.4 User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes 0.3%
• CVE-2025-9085 Medium 4.9 User Registration & Membership <= 4.3.0 - Authenticated (Admin+) SQL Injection 0.4%
• CVE-2025-6831 Medium 6.4 User Registration <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via urcr_restrict Shortcode 0.4%
• CVE-2025-3281 Medium 5.3 User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.2.1 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion 0.4%
• CVE-2025-3282 Medium 5.3 User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Unauthenticated Membership Modification 0.3%
• CVE-2025-3292 Medium 4.3 User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Password Update 0.3%
• CVE-2025-1511 Medium 6.1 User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.0.4 - Reflected Cross-Site Scripting 0.3%
• CVE-2024-4958 High 7.1 User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.2.0.1 - Missing Authorization to Privilege Escalation 0.3%
• CVE-2024-2417 High 8.8 User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation 0.9%
• CVE-2024-3295 Medium 6.5 User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Unauthenticated Media Deletion 0.9%
• CVE-2024-1720 Medium 4.7 User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.4 - Unauthenticated Stored Self-Based Cross-Site Scripting 0.5%
• CVE-2023-3342 Critical 9.9 User Registration <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Upload 1.7%
• CVE-2023-3343 High 8.8 User Registration <= 3.0.1 - Authenticated (Subscriber+) PHP Object Injection 1.1%