Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

8 records

Vendor: wpeverest Component: User Registration & Membership Clear all filters
TI-2025-26142 CVE-2025-39400 · GHSA-f95c-548w-cjmj

WordPress User Registration plugin < 4.2.0 - Reflected Cross Site Scripting (XSS) vulnerability

Priority LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration user-registration allows Reflected XSS.This issue affects User Registration: from n/a thro…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00295 Published 2025-04-24 No fix listed CWE-79
TI-2025-02262 CVE-2025-2594 · GHSA-hmpr-r93w-5j44

User Registration & Membership < 4.1.3 - Authentication Bypass

Priority HIGH 70

The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowing attackers to authenticate as any user, including administr…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.09524 Published 2025-04-22 Fixed in 4.1.3
TI-2025-02232 CVE-2025-2563 · GHSA-jxh5-f52q-732j

User Registration & Membership < 4.1.2- Unauthenticated Privilege Escalation

Priority HIGH 70

The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.49084 Published 2025-04-14 Fixed in 4.1.2
TI-2025-02874 CVE-2025-3282 · GHSA-5vm9-7r3m-24r6

Authorization bypass in wpeverest User Registration & Membership – Free & Paid…

Priority LOW 30

The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00288 Published 2025-04-12 No fix listed CWE-639
TI-2025-02881 CVE-2025-3292 · GHSA-hc93-f59p-5vw6

Authorization bypass in wpeverest User Registration & Membership – Free & Paid…

Priority LOW 20

The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00318 Published 2025-04-12 No fix listed CWE-639
TI-2025-22169 CVE-2025-30899 · GHSA-m9v4-8vpr-cf66

WordPress User Registration plugin <= 4.0.3 - Cross Site Scripting (XSS) vulnerability

Priority LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through…

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00314 Published 2025-03-27 No fix listed CWE-79
TI-2024-01599 CVE-2024-1720 · GHSA-86vf-v4p3-jf4g

Cross-site scripting in wpeverest User Registration & Membership – Free & Paid…

Priority LOW 28

The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Display Name' parameter in all versions up to, an…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00547 Published 2024-03-07 No fix listed CWE-79