WPEverest

10 results · Clear filters · Feed

• Critical 9.8
  CVE-2026-62103

  WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability

  Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions.

  WPEverest Everest Forms
  Sep 11, 2026
• Critical 9.8
  CVE-2026-74001

  WordPress User Registration & Membership Pro plugin <= 5.4.5 - Account Takeover vulnerability

  Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions.

  WPEverest User Registration & Membership Pro
  Aug 20, 2026
• Critical 9.8
  CVE-2026-4882 Public exploit

  User Registration Advanced Fields <= 1.6.20 - Unauthenticated Arbitrary File Upload

  The User Registration Advanced Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'URAF_AJAX::method_upload' function in all versions up to, and including, 1.6.20. This makes it possible for unauthen…

  WPEverest User Registration Advanced Fields Web / CMS
  May 2, 2026
• Critical 9.8
  CVE-2026-3296 Scanner template

  Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata

  The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata. This is due to the html-admin-page-entries-view.php file calling PHP's na…

  WPEverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder Web / CMS
  Apr 8, 2026
• Critical 9.8
  CVE-2026-3300 Public exploit Scanner template EPSS 39%

  Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field

  The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's process_filter() function concatenating user-submitted form field val…

  WPEverest Everest Forms Pro Web / CMS
  Mar 31, 2026
• Critical 9.8
  CVE-2026-1492 Public exploit Scanner template EPSS 29%

  User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration

  The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to improper privilege management in all versions up to, and including, 5.1.2. Th…

  WPEverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Web / CMS
  Mar 3, 2026
• Critical 9.8
  CVE-2025-60210

  WordPress Everest Forms - Frontend Listing plugin <= 1.0.5 - PHP Object Injection Vulnerability

  Deserialization of Untrusted Data vulnerability in wpeverest Everest Forms - Frontend Listing everest-forms-frontend-listing allows Object Injection.This issue affects Everest Forms - Frontend Listing: from n/a through <= 1.0.5.

  WPEverest Everest Forms - Frontend Listing
  Oct 22, 2025
• Critical 9.8
  CVE-2025-3439

  Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress <= 3.1.1 - Unauthenticated PHP Object Injection

  The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.1 via deserialization of untrusted input from the 'field_value…

  WPEverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder Web / CMS
  Apr 11, 2025
• Critical 9.8
  CVE-2025-1128 EPSS 42%

  Everest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion

  The Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file upload, read, and deletion due to missing file type and path validation in the 'format' method of the EVF_For…

  WPEverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder Web / CMS
  Feb 25, 2025
• Critical 9.9
  CVE-2023-3342

  User Registration <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Upload

  The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and missing file type validation on the 'ur_upload_profile_pic' function in versions up to, and including, 3.0.2. This makes it possible for a…

  WPEverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Web / CMS
  Jul 13, 2023