Read the docs

wpeverest

Records81All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical11CVSS 9.0–10.0
CVSS high20CVSS 7.0–8.9

Exploited now

wpeverest records in CISA KEV

No wpeverest vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Everest Forms 14 records HIGH User Registration 8 records HIGH User Registration & Membership 8 records HIGH Contact Form 1 record LOW Everest Forms Frontend Listing 1 record MEDIUM

Records

8 records in User Registration & Membership · all components

TI-2025-02262 CVE-2025-2594 · GHSA-hmpr-r93w-5j44

User Registration & Membership < 4.1.3 - Authentication Bypass

Priority HIGH 70

The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowing attackers to authenticate as any user, including administr…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.09524 Published 2025-04-22 Fixed in 4.1.3
TI-2025-02232 CVE-2025-2563 · GHSA-jxh5-f52q-732j

User Registration & Membership < 4.1.2- Unauthenticated Privilege Escalation

Priority HIGH 70

The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.49084 Published 2025-04-14 Fixed in 4.1.2
TI-2025-26142 CVE-2025-39400 · GHSA-f95c-548w-cjmj

WordPress User Registration plugin < 4.2.0 - Reflected Cross Site Scripting (XSS) vulnerability

Priority LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration user-registration allows Reflected XSS.This issue affects User Registration: from n/a thro…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00295 Published 2025-04-24 No fix listed CWE-79
TI-2025-02874 CVE-2025-3282 · GHSA-5vm9-7r3m-24r6

Authorization bypass in wpeverest User Registration & Membership – Free & Paid…

Priority LOW 30

The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00288 Published 2025-04-12 No fix listed CWE-639
TI-2024-01599 CVE-2024-1720 · GHSA-86vf-v4p3-jf4g

Cross-site scripting in wpeverest User Registration & Membership – Free & Paid…

Priority LOW 28

The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Display Name' parameter in all versions up to, an…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00547 Published 2024-03-07 No fix listed CWE-79
TI-2025-22169 CVE-2025-30899 · GHSA-m9v4-8vpr-cf66

WordPress User Registration plugin <= 4.0.3 - Cross Site Scripting (XSS) vulnerability

Priority LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through…

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00314 Published 2025-03-27 No fix listed CWE-79
TI-2025-02881 CVE-2025-3292 · GHSA-hc93-f59p-5vw6

Authorization bypass in wpeverest User Registration & Membership – Free & Paid…

Priority LOW 20

The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00318 Published 2025-04-12 No fix listed CWE-639
Open these records in search →