Wpeverest

By the Year

In 2026 there have been 39 vulnerabilities in Wpeverest with an average score of 6.6 out of ten. Last year, in 2025 Wpeverest had 21 security vulnerabilities published. That is, 18 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.08

Recent Wpeverest Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-27061	Oct 30, 2026	Subscriber <=5.3.0 XSS in User Registration Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions.	User Registration
CVE-2026-91153	Oct 29, 2026	Everest Forms 3.6.2 Sensitive Info Exposure via Public Nonce The Everest Forms Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the process. This makes it possible for unauthenticated attackers to extract arbitrary WordPress post meta values including license keys, API tokens, SMTP credentials, and Stripe or AWS secrets stored on any post type via form submission notification emails or stored entries. The submission nonce is publicly rendered in every embedded form and can additionally be minted anonymously via the nopriv everest_forms_get_form_update_nonce action, meaning no account or prior authentication of any kind is required to complete the exploit.	Everest Forms
CVE-2026-91152	Oct 29, 2026	Everest Forms WP Plugin 3.6.2 Reflected XSS via evf_toast_type The Everest Forms Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'evf_toast_type' parameter in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the sibling evf_toast parameter to decode successfully via atob(), but this is a trivially attacker-controlled prerequisite.	Everest Forms
CVE-2026-92798	Oct 17, 2026	Arbitrary Shortcode Exec in WP User Registration & Membership 5.2.8 The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::process(), where the attacker-controlled HTTP_REFERER header is only passed through sanitize_text_field() which does not strip WordPress shortcode delimiters before being substituted into a Content Restriction message that is subsequently executed via apply_shortcodes()/do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes on any restricted page whose message uses the supported {{referrer_url}} smart tag.	User Registration
CVE-2026-92978	Oct 17, 2026	WP USER Registration Plugin v5.2.8: CSRF in Bulk Action (missing nonce) The User Registration & Membership Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.8 This is due to missing or incorrect nonce validation on the trigger_bulk_action function. This makes it possible for unauthenticated attackers to force administrators to approve pending user registrations or deny arbitrary user accounts, locking targeted users out of the site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. An attacker can bypass the earlier nonce check in trigger_query_actions() by supplying an empty new_role parameter, which causes that handler to return early and cede control to the unprotected trigger_bulk_action() handler; the exit() call at the end of that handler additionally prevents WordPress core's own bulk-users nonce validation from executing.	User Registration
CVE-2026-96660	Oct 17, 2026	WP User Reg & Memb Plugin <=5.2.8 XSS via Checkbox Field (no nonce) The User Registration & Membership Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Checkbox Field Value in all versions up to, and including, 5.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nopriv AJAX action user_registration_user_form_submit reaches ur_process_registration() without nonce validation, meaning any unauthenticated request can reach the vulnerable code path.	User Registration
CVE-2026-87111	Oct 16, 2026	User Registration PRO <6.2.9: Stored XSS via Referer Header The User Registration PRO Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Referer Header in all versions up to, and including, 6.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is present only in the premium build of the plugin and is not present in the free WordPress.org distribution. The nonce required to call the vulnerable AJAX endpoint is localized into the page source of every front-end page for anonymous visitors, making it fully obtainable by unauthenticated attackers.	User Registration
CVE-2026-15222	Oct 16, 2026	WP Plugin 'User Registration & Membership' Shortcode Exec (5.2.8) The The User Registration & Membership Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.2.8. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.	User Registration
CVE-2026-74017	Sep 17, 2026	Unauthenticated Broken Access Control in User Reg <=5.2.7 (WP Plugin) Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions.	User Registration
CVE-2026-62103	Sep 11, 2026	Unauth PHP Obj Injection: Everest Forms <= 3.6.0 Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions.	Everest Forms