WPEverest vulnerabilities

CVEs per yearBy the year they were published

1. 20233
2. 20249
3. 202517
4. 202639

Newest CVEs

• CVE-2026-27061

  WordPress User Registration plugin <= 5.3.0 - Cross Site Scripting (XSS) vulnerability

  wpeverest · User Registration

  Medium6.5
• CVE-2026-91153

  Everest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})

  wpeverest · Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI

  Medium5.3
• CVE-2026-91152

  Everest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' Parameter

  wpeverest · Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI

  Medium6.1
• CVE-2026-92798

  User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag

  wpeverest · User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

  High8.1
• CVE-2026-92978

  User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()

  wpeverest · User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

  Medium4.3
• CVE-2026-96660

  User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value

  wpeverest · User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

  High7.2
• CVE-2026-87111

  User Registration PRO <= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer Header

  WPEverest · User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin

  High7.2
• CVE-2026-15222

  User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name

  wpeverest · User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

  Medium5.4
• CVE-2026-74017

  WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability

  wpeverest · User Registration

  Medium5.3
• CVE-2026-62103

  WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability

  wpeverest · Everest Forms

  Critical9.8