WPEverest vulnerabilities
71 published CVEs name WPEverest among the affected products.
- 71Published CVEs71 of them scored
- 43Last 12 monthspublished in the last year
- 10Critical19 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-115483
Everest Forms <= 3.6.3 - Unauthenticated Arbitrary File Read via 'Signature' Field Meta Key Branch of attach_entry_files
wpeverest · Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
High7.5 - CVE-2026-120513
Everest Forms <= 3.6.2 - Unauthenticated Arbitrary File Deletion via 'everest_forms_{form_id}_old_{field_id}' Parameter
wpeverest · Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
High8.2 - CVE-2026-89101
Everest Forms <= 3.6.2 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP /tools/call JSON-RPC Endpoint
wpeverest · Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
Medium6.5 - CVE-2026-27061
WordPress User Registration plugin <= 5.3.0 - Cross Site Scripting (XSS) vulnerability
wpeverest · User Registration
Medium6.5 - CVE-2026-91153
Everest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})
wpeverest · Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
Medium5.3 - CVE-2026-91152
Everest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' Parameter
wpeverest · Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
Medium6.1 - CVE-2026-92798
User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag
wpeverest · User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
High8.1 - CVE-2026-92978
User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()
wpeverest · User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
Medium4.3 - CVE-2026-96660
User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value
wpeverest · User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
High7.2 - CVE-2026-87111
User Registration PRO <= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer Header
WPEverest · User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin
High7.2